URL Encoder / Decoder
Percent-encode or decode text with the right function for the job, then paste any full URL to see its protocol, host, path and every query parameter decoded one by one.
Escapes everything except A–Z a–z 0–9 - _ . ! ~ * ' ( ). Use it on a single
parameter value.
Query string reader
Paste any full URL and press Read URL to split it into its parts and list every query parameter with its raw and decoded values.
No URL read yet
| Protocol | — |
|---|---|
| Host | — |
| Port | — |
| Path | — |
| Fragment | — |
Query parameters
| Name | Raw value | Decoded value | Copy |
|---|---|---|---|
| — | |||
No parameters yet. Read a URL that contains a query string and every name, raw value and decoded value will appear here.
How percent-encoding works
A URL can only carry a limited set of characters safely. Percent-encoding, standardised in RFC 3986,
is the escape hatch: any character that is not in the unreserved set is replaced by a percent sign
followed by two hexadecimal digits for each byte of its UTF-8 encoding. That last detail matters for
anything non-English — café becomes caf%C3%A9, six characters, because the
é is two UTF-8 bytes rather than one.
The unreserved set never needs escaping: A–Z, a–z, 0–9, and
the four punctuation characters -, _, . and ~.
Everything else has a meaning somewhere in a URL — ? starts a query string,
# starts a fragment, / separates path segments, &
separates parameters, = separates a name from its value, and + is read as a
space by form-encoded decoders.
| Character | Meaning in a URL | encodeURI leaves it | encodeURIComponent leaves it |
|---|---|---|---|
& | Separates query parameters | Yes | No — becomes %26 |
= | Separates name from value | Yes | No — becomes %3D |
? | Starts the query string | Yes | No — becomes %3F |
/ | Separates path segments | Yes | No — becomes %2F |
# | Starts the fragment | Yes | No — becomes %23 |
| space | Not allowed at all | No — becomes %20 | No — becomes %20 |
Why picking the wrong function breaks query strings
encodeURI assumes you are handing it a complete, already-structured address, so it
deliberately leaves the structural characters alone. That is exactly right for
https://example.com/a b/c, and exactly wrong for a single value. If a search term
contains an ampersand and you encode it with encodeURI, the ampersand survives and the
server sees a new parameter that you never intended:
// A value the user typed:
Tom & Jerry
// Wrong: encodeURI leaves the & alone, so the query is split in two.
?q=Tom%20&%20Jerry&lang=en
// → q = "Tom ", lang = "en", and a stray parameter named " Jerry"
// Right: encodeURIComponent escapes the & as %26 and it stays data.
?q=Tom%20%26%20Jerry&lang=en
// → q = "Tom & Jerry", lang = "en"
The same failure happens with =, with + and with anything else that is
reserved. The reliable habit is: build the URL from parts and run
encodeURIComponent on each individual name and value before you join them with
& and =. If you have a URL object available, setting the search
parameters through URLSearchParams does that escaping for you.
Decoding is the mirror image. decodeURIComponent throws a URIError on a
malformed sequence such as a lone %, so this tool catches that and reports it instead
of failing silently or showing a blank result.
What this tool does not claim: it cannot tell you that a URL is reachable, that its host
exists, or that a server will interpret the parameters the way you expect. It only applies the
standard escaping rules and, in the reader below, the standard parsing rules from the WHATWG URL
standard. Query parameters that repeat — ?tag=a&tag=b — are listed as separate rows
rather than merged into one, because that is what the byte stream actually contains.
How to use this tool
- Pick the right mode. Choose Component for a single value such as a
search term or a redirect target, and Full URL when you are escaping a whole address that
already has its
?and&in place. - Type and watch. The result updates live as you type; there is no Apply button. The note under the modes always spells out which characters the current function leaves alone.
- Decode to check your work. Switch to Decode to turn
%20and%26back into readable text, so you can confirm a value survived a round trip through some other system. - Read a full URL. Paste an address into the query string reader and press Read URL. Protocol, host, port, path and fragment are laid out in a table, and each query parameter is listed with its raw value next to its decoded value.
- Copy anything. Each output has its own copy button — the encoded or decoded
result, and the full parameter list as
name=valuelines once a URL has been read.
Frequently asked questions
What is the difference between encodeURI and encodeURIComponent?
encodeURI is designed for a complete URL and leaves the reserved characters that give a URL its structure untouched — : / ? # & = + $ , ; @ and more. encodeURIComponent is designed for a single piece of a URL, such as one query value, and escapes all of those reserved characters. Use encodeURI on a whole address and encodeURIComponent on every individual parameter value.
Why does my search break when a value contains & or =?
Because & separates parameters and = separates a name from its value inside a query string. If you build ?q=Tom & Jerry by hand, the server reads two parameters: q=Tom and Jerry with an empty value. Running the value through encodeURIComponent first produces Tom%20%26%20Jerry, and the ampersand is then just data.
Which characters are never encoded?
Percent-encoding leaves the unreserved set alone: A–Z, a–z, 0–9, hyphen, underscore, period and tilde. Those characters are safe in every part of a URL, so all three functions pass them through unchanged. Everything else is replaced by % followed by two hexadecimal digits of its UTF-8 bytes.
Are %20 and + the same thing in a query string?
No, and the difference causes real bugs. Percent-encoding represents a space as %20. The plus sign as a shorthand for a space comes from HTML form encoding, application/x-www-form-urlencoded, and is only interpreted that way by decoders that expect it. encodeURIComponent never produces + for a space, so %20 is the safer choice in a URL.
Sources & further reading
- RFC 3986 — Uniform Resource Identifier (URI): Generic Syntax — Defines the reserved and unreserved character sets and the percent-encoding rules, including section 2.4 on when to encode and decode.
- MDN Web Docs — encodeURIComponent() — Lists exactly which characters each function escapes, and documents the URIError thrown on a lone surrogate or malformed escape sequence.
- WHATWG URL Standard — application/x-www-form-urlencoded — Specifies how query strings are parsed and serialised, and why plus is treated as a space only in form-encoded data.