URL encode and decode
Percent-encode text for a URL, or decode %20-style escapes back to text. Paste a full URL to see its host, path and every query parameter decoded. Everything runs in your browser.
URL parts
| Parameter | Value |
|---|
How to URL encode or decode
- To encode, type or paste text on the left. The percent-encoded version appears on the right, ready to put in a link or a query string.
- To decode, paste encoded text such as
caf%C3%A9%20au%20laiton the right. The readable text appears on the left. - To inspect a URL, paste it on the left. Its scheme, host, port, path, fragment and every query parameter are listed below, decoded.
Which encoding mode?
- Component matches JavaScript's
encodeURIComponent. Use it for a single query value or path segment: it encodes& = ? / #so they can't break the URL. - Full URL matches
encodeURI. Use it on a whole URL that has spaces or accents: the: / ? # & =that give the URL its structure are kept. - Form (+) is
application/x-www-form-urlencoded, used by HTML forms,URLSearchParamsand most POST bodies. Spaces become+, and a+decodes back to a space. - RFC 3986 leaves only letters, digits and
- _ . ~unencoded. OAuth 1.0 signatures and AWS Signature V4 need exactly this, whichencodeURIComponentdoesn't give you (it leaves! ' ( ) *).
What percent-encoding is
URLs may only contain a limited set of ASCII characters. Anything else is written as UTF-8 bytes, each as % plus two hex digits: a space is %20, é is %C3%A9, and an emoji takes four escapes. Characters that have a meaning in URLs, such as & and =, must also be escaped when they are part of a value.
Common problems
- Double encoding:
%2520is an encoded%20. It happens when encoded text is encoded again. The tool notices leftover escapes after decoding and offers to decode again. - "URI malformed": JavaScript's
decodeURIComponentthrows on a lone%or on escapes that aren't UTF-8 (such as Latin-1%E9). This tool keeps stray%signs and tells you exactly where the bad escape is. - Plus or %20? In a query string from a form,
+means a space. In a path it is a literal plus. Pick Form (+) or Component to match.
URL encoding in code
- JavaScript:
encodeURIComponent(s),decodeURIComponent(s),new URLSearchParams({ q: s }).toString() - Python:
urllib.parse.quote(s, safe=""),urllib.parse.unquote(s),urllib.parse.urlencode({"q": s}) - PHP:
rawurlencode($s)(RFC 3986),urlencode($s)(form, + for spaces) - Go:
url.PathEscape(s),url.QueryEscape(s) - Shell:
curl -G --data-urlencode "q=hello world" https://example.com
Questions
What is the difference between encodeURI and encodeURIComponent?
encodeURI is for a whole URL and leaves the characters that structure it (: / ? # & =) alone. encodeURIComponent is for one piece, such as a query value, and encodes those characters too, so a value containing & or = can't break the URL.
Should a space be %20 or +?
Both are correct in different places. %20 works everywhere. + means a space only in form-encoded query strings and POST bodies (application/x-www-form-urlencoded). In a path, + is a literal plus sign.
Why does decoding fail with "URI malformed"?
The text has a % that isn't followed by two hex digits, or escapes that aren't valid UTF-8, for example %E9 from an old Latin-1 system. This tool keeps stray % signs and points at the bad escape instead of failing.
What does %2520 mean?
It is a double-encoded space: %25 is the encoding of % itself, so %2520 decodes to %20, which decodes to a space. Use Decode again to undo both layers.
Which characters never need encoding?
Letters A–Z and a–z, digits 0–9, and - _ . ~ are unreserved in RFC 3986 and are never encoded. Everything else may need encoding depending on where it appears in the URL.
Is my data sent anywhere?
No. Encoding, decoding and URL parsing all run in your browser, so tokens or private URLs you paste are never uploaded.