utilyfe

URL Encoder and Decoder

Encode one piece of a URL or a whole one, decode what someone sent you, and read the query parameters.

Runs entirely in your browser. Nothing you enter is uploaded or stored.

Also try:Base64 Encoder and DecoderJSON FormatterJWT Decoder

How to use the URL Encoder and Decoder

  1. 1Choose Encode or Decode and paste your text or URL into the box.
  2. 2When encoding, pick the scope: Component for one query value or path segment, Full URL when the address is already assembled.
  3. 3When decoding, leave "Treat + as space" ticked for anything that came from a web form or a query string.
  4. 4If what you paste is a URL or query string, the parameters appear underneath, already decoded.
  5. 5Press Copy to take the result.

Component or full URL

This is the choice that decides whether the result works, and it’s the one most tools skip.

Component escapes everything that has a meaning inside a URL. Use it for a single value: a search term, a redirect target, a filename in a path.

Full URL assumes the address is already built, and leaves the structural characters alone: : / ? # & =. Use it to tidy an address that contains spaces or accented letters.

Character Component Full URL
space %20 %20
? %3F kept
& %26 kept
= %3D kept
/ %2F kept
# %23 kept
é %C3%A9 %C3%A9

The rule of thumb: if the text you’re encoding will sit inside a URL, use Component. If the text is the URL, use Full URL.

Characters that never need encoding

A–Z, a–z, 0–9, and - _ . ~ are the unreserved set from the URL standard. They pass through untouched here, and they’re safe to leave as they are anywhere in a URL.

A few others: ! * ( ) ': are legal in a URL but are escaped by some tools and not others. Both forms work; the difference is cosmetic.

Why + sometimes means a space

Long before the modern URL standard, HTML forms encoded a space as +. That convention survives in query strings, so ?q=hello+world and ?q=hello%20world usually mean the same thing to a server.

Two things follow:

  • When decoding, + is ambiguous: it might be a space, or a real plus sign in something like a maths expression or an email address. Leave the option ticked for form data and query strings; untick it when the value is a path segment or a signed token, where a + is meant literally.
  • When encoding, %20 is the safer default. Use + only for a query value that a form-style endpoint expects.

Double encoding

A value encoded twice is a common bug in redirect chains and analytics links: a space becomes %20, and then that % becomes %25, leaving %2520.

You’ll see it as %25 sitting where a real value should be. Decoding once gives you %20, and this page points that out rather than leaving you to notice. Decode again for the real text. The cure is to encode once, at the point where the value is put into the URL, and never again afterwards.

The parameter breakdown

Paste a URL or a bare query string and the parameters appear in a table, each already decoded. It’s the fastest way to read a long tracking link, check what a redirect is carrying, or find the one parameter that’s malformed. Repeated keys are listed separately, in the order they appear, because that’s how servers usually read them.

Questions

Why did encoding my whole URL break it?
Because Component mode escapes the characters that give a URL its structure, so :// becomes %3A%2F%2F and the address stops working. Component mode is for one value going inside a URL. For an address that's already put together, switch to Full URL, which leaves the structure alone and only escapes spaces and other unsafe characters.
Should a space be + or %20?
%20 always works. The + form comes from HTML form submissions, where a space is written as +, and it's only understood inside a query string: never in a path. If you're building a query value for a form-style endpoint, tick "Spaces as +"; otherwise leave it off.
Why does my accented letter turn into two codes?
Percent-encoding works on bytes, not letters, and the web uses UTF-8. The letter é is two bytes, so it becomes %C3%A9, and an emoji is four bytes, so it becomes something like %F0%9F%91%8D. That's correct and every server will decode it back.
What does %2520 mean?
It's a value that was encoded twice: %20 (a space) had its own % encoded again, giving %2520. If decoding leaves you with % escapes still in the result, this page says so: decode a second time to get the real value.
Is anything sent to a server?
No. Encoding, decoding and the parameter breakdown all run in this browser tab, which matters when the URL carries a session token or a signed link. Nothing is uploaded, logged or saved.