URL Encoder and Decoder

The three modes behave like the standard JavaScript functions, so results match what code produces.

1. Paste your text or address into the Input box.
2. Choose a Mode. Encode (component) is the default and suits one value, such as a search term. Encode (full URL) suits a complete address. Decode turns percent sequences back into text.
3. When decoding, leave Treat + as space when decoding ticked for data from web forms, or untick it if plus signs are real plus signs.
4. Read the output. If the percent sequences are broken, the note says Malformed percent-encoding and the output stays empty.
5. Press Copy, Download .txt or Use as input.

Component mode is encodeURIComponent, full URL mode is encodeURI and decoding is decodeURIComponent. All three run on your device, so private addresses and tokens are not sent anywhere.

Percent encoding replaces each unsafe byte with a percent sign and two hex digits of its UTF-8 value. A space is %20, & is %26, é is %C3%A9 and the euro sign is %E2%82%AC. Component mode escapes everything except letters, digits and - _ . ! ~ * ' ( ), so it also escapes the separators / ? # & = : +. Full URL mode additionally leaves those separators alone so the address keeps its shape.

The component result is useless as a link, but exactly right as a value inside another URL, such as a redirect parameter. Note that component mode writes a plus sign as %2B, which is how you keep a literal plus in a query value such as a+b=c, encoded as a%2Bb%3Dc.

In data sent by an HTML form, a space is often written as +, while in a URL path a plus is just a plus. That is what the checkbox decides: a%20b%26c+d decodes to a b&c d with it ticked and a b&c+d without.

A %2520 in a log is a space that was encoded twice, because the percent sign itself became %25. Decode once, press Use as input, and decode again. Full URL mode also escapes a bare % as %25, so running it over an address that is already encoded double-encodes it. The decoder expects UTF-8: a lone %E9 from a Latin-1 system fails with the malformed note, whereas %C3%A9 gives é. See exactly how those byte pairs are built in the UTF-8 encoder.

Typical jobs include building a link with a search term or a nested URL, preparing the subject and body of a mailto: link (the subject Hello world & more becomes Hello%20world%20%26%20more), reading encoded referrers in analytics, and debugging an API request. For campaign links, the UTM builder encodes the parameters for you, and the URL slug generator makes clean path segments instead of escaping them.

A short checklist helps. Encode each value once, as late as possible, and decode it once, as early as possible. Never encode a value and then paste it into a tool or library that encodes it again.

The tool encodes the whole input as one piece. It does not split a URL into scheme, path and query, does not convert international domain names, and is not a way to hide anything: percent encoding is public and reversible. To pack bytes into text rather than escape characters, use the Base64 encoder.

Escapes worth recognising on sight: %20 space, %22 quote, %23 hash, %25 percent, %26 ampersand, %2B plus, %2F slash, %3A colon, %3D equals, %3F question mark and %40 at sign. Hex digits in an escape may be upper or lower case, and this tool writes them in capitals.