URL Decode and Encode

Decode percent-encoded URLs or encode text for query parameters, paths, redirects, and API calls.

input.txt
output.txt
Encode text to a URL-safe format, or decode a URL-encoded string.

URL Encode & Decode

Percent-encoding represents a byte with % followed by two hexadecimal digits. A space becomes %20, & becomes %26, and / becomes %2F when those characters are encoded as part of one component.

This tool follows JavaScript's encodeURIComponent and decodeURIComponent. Use it for the value of a query parameter or one dynamic path segment, not for blindly encoding an entire URL. Encoding https://example.com/search?q=test as one component will also escape the :, /, ?, and = separators that give the URL its structure.

Example

Plain text: hello world & more

URL encoded: hello%20world%20%26%20more

  • Query values — encode the value separately before placing it after key=.
  • Path segments — encode user-controlled text before inserting it between / separators.
  • Nested redirect URLs — encode the entire inner URL only because it is the value of an outer parameter.

Unicode text is converted through UTF-8 percent sequences. Decoding fails when a % escape is incomplete, contains non-hexadecimal characters, or produces invalid UTF-8.

Form encoding adds a separate + rule

HTML form query encoding commonly represents a space as +. decodeURIComponent does not apply that rule; it leaves a literal plus sign unchanged. Replace + with a space before decoding only when you know the value came from application/x-www-form-urlencoded data. Doing so unconditionally would corrupt a genuine plus sign.

Encoding does not make a URL trustworthy

Representational steps like percent-encoding are not input validation and are not a security boundary. Validate the decoded value of a redirect target, hostname, path or command parameter as appropriate for the application’s use. The decoded value may still have traversal sequences, untrusted origin, or content which needs to be escaped in other contexts.

FAQ

Why doesn't my + decode to a space?

Because this tool follows decodeURIComponent. The plus-to-space conversion belongs to form encoding, so apply it only when that is the format you received.

Should I encode a complete URL?

Not usually. Encode individual parameter values or path segments instead — encoding the whole URL destroys the structural delimiters that give it meaning. Encode a complete URL only when it is embedded as data within some other URL component.