URL Encoder / Decoder

URL Encoding and Decoding

URL encoding, also called percent-encoding, converts characters that have special meaning or are unsafe in a URL into % followed by two hexadecimal digits. A space becomes %20, & becomes %26, and = becomes %3D.

Encoding prevents data from being confused with URL structure. For example, an ampersand inside a search term should remain part of that term instead of starting another query parameter.

Component encoding versus full URL encoding

Mode	JavaScript API	Best for	Preserves
Component	encodeURIComponent	Query values, form values, path segments	Only characters safe inside one value
Full URL	encodeURI	A complete URL containing its own structure	Slashes, query markers, fragments, and separators

Use component mode for a value:

const query = "rock & roll";
const url = `/search?q=${encodeURIComponent(query)}`;
// /search?q=rock%20%26%20roll

Use full URL mode when the input already contains URL structure:

const url = "https://example.com/search?q=rock & roll";
encodeURI(url);
// https://example.com/search?q=rock%20&%20roll

Full URL encoding preserves separators, so it should not replace component encoding for query parameter values. Encode each value before assembling a URL.

Decoding percent-encoded text

Decoding reverses percent-encoding:

decodeURIComponent("hello%20world%20%26%20more");
// hello world & more

This tool also treats + as a space while decoding, which matches common query-string and HTML form conventions. Strict percent-encoding uses %20 for spaces; + is not a universal replacement.

Python and PHP provide equivalent APIs:

from urllib.parse import quote, unquote

encoded = quote("hello world & more")
decoded = unquote(encoded)

$encoded = rawurlencode("hello world & more");
$decoded = rawurldecode($encoded);

Common URL encoding uses

• Encode search terms and filter values in query strings.
• Preserve user-entered text inside links and redirects.
• Encode path segments that may contain spaces or reserved characters.
• Decode API parameters before displaying or processing them.
• Safely embed one URL inside another URL.

Always encode values at the boundary where they become URL data. Avoid encoding an already encoded value, because % can become %25 and decoding may require multiple passes.

Malformed input

Decoding requires every percent sign to be followed by two hexadecimal digits. Input such as %2 or %ZZ is malformed and cannot be decoded reliably. The tool reports an error instead of returning partial text.

Encoding and decoding happen in the browser. Do not treat encoded text as a security control: validate URLs, restrict allowed schemes, and sanitize untrusted HTML separately when accepting user input.