URL Encoder / Decoder
Percent-encode and decode URLs, with component and full-URL modes.
URL encoding
Private by design. Everything runs locally in your browser. Your input is never uploaded, logged or stored on a server.
How to use the URL Encoder / Decoder
- Paste the value or the URL.
- Pick the scope: Component escapes
&,=,?,/and#; Full URL leaves that structure intact. - Switch between encode and decode.
- Watch for the double-encoding warning —
%25sequences mean something upstream encoded twice.
A worked example
a b&c=d
a%20b%26c%3Dd
Component scope. In Full URL scope the & and = survive untouched, which is correct for an assembled address and wrong for a single parameter value.
Frequently asked questions
What is URL encoding?
Also called percent-encoding, it replaces characters that are unsafe or reserved in a URL with a % followed by their hexadecimal byte values, so the URL parses unambiguously.
When should I use component mode instead of full URL mode?
Use component mode for a single value you are inserting into a query string or path segment. Use full URL mode when encoding an already-assembled URL that must keep its ?, & and / structure.
Why did my encoded URL break?
Almost always double encoding: the string was already encoded and got encoded again, turning %20 into %2520. Decode once before re-encoding.
Does it support non-ASCII characters?
Yes. Characters are encoded as their UTF-8 bytes, which is what modern browsers and servers expect.
About the URL Encoder / Decoder
URLs may only contain a restricted ASCII set, so anything else is percent-encoded: a % followed by the two hex digits of each UTF-8 byte. A space becomes %20, and 日 becomes %E6%97%A5.
Choosing the right mode matters. Component mode (encodeURIComponent) escapes the reserved characters &, =, ?, / and # — that is what you want for a single query-parameter value, otherwise a value containing & silently splits into two parameters. Full URL mode (encodeURI) leaves those characters intact because they are structural, and only escapes spaces and non-ASCII.
Maintained by Ikonode. Last checked against the code on 11 September 2026.
What it does not do
- It escapes characters; it does not validate that the result is a reachable URL.
- A space becomes
%20. Form-encoded query strings use+for the same thing, and the two are not interchangeable in a path. - Decoding is applied once per press, deliberately — silently decoding twice is how path-traversal payloads slip through.