URL Encode and Decode
Percent-encode and decode URL text, with the component-versus-whole-URI distinction handled correctly — the thing that silently breaks query parameters. A breakdown below shows each part of a URL and every decoded query parameter.
How it works
Component or whole URI — the distinction that matters
There are two encoding functions, and picking the wrong one is the usual cause of a broken query parameter.
- Component (
encodeURIComponent) escapes everything that is not unreserved, including&,=,?,/and:. Use it for a single value you are about to drop into a URL. - Whole URI (
encodeURI) leaves the characters that give a URL its structure intact. Use it only on a complete URL you want to make safe without destroying it.
Encoding a value with the whole-URI function leaves any & inside it unescaped, so the value splits into two parameters. That is the bug.
Reserved, unreserved, and the plus sign
Unreserved characters — A–Z a–z 0–9 - _ . ~ — are never encoded. Reserved characters have structural meaning and are encoded when they appear as data.
The space is a special case. In form submissions a space is encoded as +; everywhere else it is %20. encodeURIComponent always produces %20, which query strings accept too. But when decoding form data, a literal + means a space — so decoding with the wrong function turns C++ into C .
Double encoding
Encoding an already-encoded string turns %20 into %2520, because the % itself gets escaped. If you see %25 in a URL that should contain a space, something encoded twice. Decode repeatedly until the string stops changing to recover the original.
What people use it for
- Building a query string with values containing spaces, ampersands or slashes.
- Reading an encoded URL from a log or a redirect chain.
- Debugging a parameter that arrives truncated — usually an unescaped ampersand.
- Encoding a redirect URL to pass safely as a parameter inside another URL.
- Breaking a long URL into its parts to see exactly what is being sent.
Nothing is uploaded. This tool runs entirely in JavaScript in your browser. Your input is never sent to a server, never logged and never stored, and no account is required. Once the page has loaded you can go offline and it still works — open your browser's network tab and watch if you'd like to confirm it.
Frequently asked questions
What is the difference between encodeURI and encodeURIComponent?
encodeURIComponent escapes everything that is not unreserved, including ampersand, equals, question mark and slash, and is what you want for a single value. encodeURI leaves URL structure characters intact and is only for a complete URL. Using encodeURI on a value leaves embedded ampersands unescaped, which splits it into extra parameters.
Why is my space sometimes a plus and sometimes %20?
Form submissions encode a space as a plus sign. Everywhere else a space is %20. Both are accepted in query strings, but when decoding form data a literal plus means a space.
What does %25 mean in a URL?
An encoded percent sign, which almost always means the string was encoded twice: %20 became %2520. Decode repeatedly until the result stops changing.
Which characters are never encoded?
The unreserved set: letters, digits, hyphen, underscore, period and tilde. Everything else may be encoded, and reserved characters are encoded when they appear as data rather than as structure.
Is my URL sent anywhere?
No. Encoding, decoding and parsing all happen in your browser.
Tools that run where your code is
This page does its work in your browser because sending your data to a server to process it is a bad default. Catalase applies the same idea to AI coding: a free, open-source code editor that runs language models on your own machine through Ollama, with no account and no telemetry. Cloud models are there when you choose one, not by default.
Related tools
- Base64 encode / decode — The other common transport encoding.
- Slug generator — URL-safe slugs from titles.
- JWT decoder — Decode a token's claims.