URL Encode / Decode
Percent-encode text for a URL, or decode it back to plain — component and full-URI modes.
Runs on every keystroke. Nothing leaves the browser.
Hello%20world!%20a%3D1%26b%3D2
RFC 3986 percent-encoding · component mode escapes ? = & / : #
Component encoding is for one value inside a query string, not for a whole URL. Form data mode writes spaces as +, which is application/x-www-form-urlencoded rather than RFC 3986.
How it works
Paste the text or URL fragment into the input. It re-runs on every keystroke, in the browser.
Pick Encode (text to %XX) or Decode (%XX back to text).
Leave Component on for a single query-parameter value — it escapes ?, = and &. Turn it off to encode a whole URL and keep its structure intact.
Turn on Form data when + means space rather than a literal plus, which is how application/x-www-form-urlencoded bodies are written.
Percent-encoding
Every byte outside the unreserved set is written as % followed by two hex digits of its UTF-8 value; decoding reverses it. Component mode escapes the reserved delimiters as well, because a value containing one would otherwise be read as structure rather than as content.
a=1&b=2 → a%3D1%26b%3D2 é → %C3%A9
Use cases
Query-parameter values
User input going into ?q= has to be component-encoded. An unescaped & ends the parameter early and everything after it silently becomes a different parameter.
Path segments in REST calls
A segment carrying a slash, a colon or a space splits the route before the handler ever sees it. Encode the segment, not the URL around it.
Reading access logs
A server records the raw request line, escapes and all. Decode it to see what was actually asked for.
mailto: links
subject and body are query parameters. A newline has to be %0A — a raw one truncates the link at that point.
Deep links carrying a URL
When a custom-scheme link passes another URL as a parameter, the inner one must be component-encoded or its query string merges into the outer one.
Form bodies
application/x-www-form-urlencoded writes spaces as +. Decoding that with plain decodeURIComponent leaves the plus signs sitting in the text.
Non-ASCII text
Percent-encoding operates on UTF-8 bytes, so one character can become several escapes: é is %C3%A9, not %E9. A single-escape sequence is a latin-1 encoder, and it will not round-trip.
Questions
- Component or full URI?
- encodeURIComponent escapes ?, =, &, /, : and # — use it for one value going into a query string. encodeURI leaves those alone so a whole URL stays a URL. Running a complete URL through the component variant produces a string no client will route.
- Is anything sent to a server?
- No. Both directions are the browser's own encodeURIComponent and decodeURIComponent, running on this page. The text never leaves the tab.
- Why is my + still a +?
- decodeURIComponent treats + as a literal plus, which is correct under RFC 3986. Only application/x-www-form-urlencoded gives it the meaning 'space'. Turn on Form data to convert it first.
- Why does it say invalid percent sequence?
- decodeURIComponent throws on a % that is not followed by two hex digits, and on an escape sequence that is not valid UTF-8. A bare % in otherwise plain text is the usual cause — it has to be written %25.
- Does this match RFC 3986 exactly?
- Close, not exactly. encodeURIComponent leaves ! ' ( ) * unescaped and RFC 3986 lists them as sub-delimiters. They are accepted in a query value in practice; escape them by hand if a strict parser on the other end refuses them.
More tools
One of 18 free tools here. They come out of building utility apps for macOS, iOS and the browser — all of it by one person.
See the apps