Skip to content
OfflineBench

URL encode and decode

Encode and decode URLs and query strings, or split a URL into its parts. Right in your browser; nothing is uploaded.

0 bytes uploadedProcessed on this device How it works

Input

Type or paste text to encode.

Output

Nothing to show yet

Type or paste text. The encoded result appears here.

How to encode, decode or parse a URL

  1. Choose Encode, Decode or Parse. The result updates as you type.
  2. To encode a single value, such as a query parameter, keep Component. To make a whole address safe while keeping its /, ? and &, choose Full URL.
  3. To decode, paste the encoded text. Turn on + as space for query strings and form data.
  4. To parse, paste a full URL. You get the scheme, host, port, path, each query parameter decoded, and the fragment, each with a copy button.

Options

Component
Like JavaScript’s encodeURIComponent: encodes everything except letters, digits and - _ . ! ~ * ' ( ).
Full URL
Like encodeURI: also keeps the characters that structure a URL, such as : / ? # & =. A % is still encoded, so text that is already encoded gets encoded twice.
Space as +
Writes spaces as +, as HTML forms do. A real plus sign is still encoded as %2B. Only for Component.
+ as space
When decoding, reads + as a space. %2B still decodes to a plus sign.

How percent-encoding works

URLs may contain only a limited set of ASCII characters, and some of those, such as &, = and #, separate the parts of the URL. Percent-encoding writes any other character as its UTF-8 bytes in hex: a space becomes %20, ü becomes %C3%BC, and 👋 becomes %F0%9F%91%8B.

Parsing uses the same URL rules as the browser. International domain names are shown both as typed (münchen.de) and in the ASCII form browsers send (punycode, xn--mnchen-3ya.de).

Troubleshooting

  • “… isn’t a valid escape.” A % must be followed by two hex digits. Write a literal percent sign as %25.
  • “… isn’t valid UTF-8.” The text was probably encoded with another character set, such as Latin-1 (caf%E9 instead of caf%C3%A9), or cut off in the middle of a character.
  • “This URL has no scheme.” Parsing needs the full address, including https://.
  • %20 became %2520. The text was already encoded, and encoding it again turned each % into %25. Decode it instead, or encode the original text.

How your data stays private

Everything happens in your browser, on your device. Your files and text are never uploaded, never stored, and never put in the address bar.

  • The site’s security policy (connect-src 'self') tells your browser to block any attempt by the page to send data to another server.
  • Only your preferences, such as the theme and a tool’s last-used options, are saved in your browser’s local storage. Never your content.
  • To check it yourself, open your browser’s developer tools, select the Network tab, and use the tool: no request carries your data.

There is no account, no sign-up and no watermark. After your first visit, pages open without a connection; a tool’s larger parts, such as the PDF and image engines, are saved the first time you use it, so it works offline from then on.

Frequently asked questions

How do I URL-encode a space: %20 or +?

Both are used. %20 is correct anywhere in a URL. + means a space only in query strings and HTML form data (application/x-www-form-urlencoded). Choose “Space as +” when you are building form data or a query string for a server that expects it; otherwise keep %20.

What characters need URL encoding?

When you encode a single value, such as a query parameter, everything except letters, digits and - _ . ~ (the “unreserved” characters of RFC 3986). The Component option, like encodeURIComponent, also leaves ! ' ( ) * as they are. Characters like & = ? / # have a meaning in URLs, so a value containing them must be encoded, or the URL will be read differently. Non-ASCII characters, such as ü or emoji, are encoded as their UTF-8 bytes, for example ü becomes %C3%BC.

What is the difference between encodeURI and encodeURIComponent?

encodeURIComponent encodes a single part, such as one query value, and escapes the characters that separate URL parts (: / ? # & =). encodeURI encodes a whole URL and leaves those separators alone, so the URL keeps working. Use “Component” for values and “Full URL” for complete addresses with spaces or non-ASCII characters.

Why does decoding fail?

Either a “%” isn’t followed by two hex digits (a literal percent sign must be written %25), or the escapes don’t form valid UTF-8, for example text encoded with an older character set such as Latin-1. The error shows the line and column of the first problem.

Can it decode Safe Links or Proofpoint URLs?

Partly. A Microsoft Safe Links address carries the target, percent-encoded, in its url parameter, so Parse shows it decoded. Proofpoint URL Defense uses its own encoding, which this tool doesn’t reverse, and no vendor format is unwrapped automatically.

Is my URL sent anywhere?

No. Encoding, decoding and parsing run in your browser, on your device. Nothing is uploaded, stored or put in the address bar, and the page doesn’t open the URL you parse. Passwords in URLs are hidden on screen.

Related tools