Skip to content
TrueScalers

URL encoder and decoder

URL encoding replaces unsafe characters with a percent sign followed by two hexadecimal digits of their UTF-8 bytes. A space becomes %20 and an ampersand becomes %26. Component mode escapes the reserved delimiters & = ? / # so a value is safe inside one query parameter; whole-URL mode leaves them intact so the URL structure survives.

Loading tool…

How to encode and decode a URL

  1. 01

    Choose a direction

    Select encoding to convert text into percent-escapes, or decoding to turn percent-escapes back into readable text.

  2. 02

    Choose the scope

    Pick component for a single query value, which escapes the reserved delimiters, or whole URL to keep the structure intact.

  3. 03

    Paste your input

    Type or paste into the input pane. Conversion runs live as you type, with no button and no upload.

  4. 04

    Read the parameter breakdown

    When the input is a full URL, each query parameter is listed separately with its decoded value.

The formula

unreserved = A–Z a–z 0–9 - _ . ~     everything else → %XX per UTF-8 byte
unreserved
Characters RFC 3986 guarantees never need escaping, and which must not be escaped.
reserved
Delimiters with structural meaning — : / ? # [ ] @ ! $ & ' ( ) * + , ; = — escaped in component mode only.
%XX
A percent sign followed by two hexadecimal digits representing one byte.
UTF-8
The encoding applied before percent-escaping, so one character may become several %XX sequences.

Non-ASCII characters are encoded as multiple bytes: é is two UTF-8 bytes and becomes %C3%A9, while an emoji is four bytes and becomes four escapes. Choosing whole-URL mode when component mode was needed is the single most common URL bug — it leaves an ampersand unescaped inside a value, which silently truncates the parameter at the server.

Worked example

Input
mortgage calculator & rates
Direction
Encode
Scope
Component
Result
mortgage%20calculator%20%26%20rates

Each space is a single byte, 0x20, and becomes %20. The ampersand is 0x26 and becomes %26, which is essential: left unescaped inside a query value, it would be read as the start of the next parameter and the value would be truncated at "mortgage calculator". The 27-character input becomes 35 characters. In whole-URL mode the ampersand would have been preserved, which is correct only when encoding an entire URL rather than one value inside it.

Frequently asked questions

What is URL encoding?

URL encoding, also called percent-encoding, replaces characters that are unsafe or reserved in a URL with a percent sign and two hexadecimal digits representing their UTF-8 bytes. Defined in RFC 3986, it lets arbitrary text travel inside a URL without being mistaken for structural syntax such as a parameter separator.

What is the difference between encodeURI and encodeURIComponent?

encodeURIComponent escapes everything except the unreserved set, including & = ? / and #, which is correct for a single value going inside a query parameter. encodeURI leaves those delimiters intact because it expects a complete URL. Using encodeURI on a value that contains an ampersand corrupts the query string.

Why does a space become %20 and not a plus sign?

Both appear, in different contexts. RFC 3986 percent-encoding renders a space as %20 anywhere in a URL. The older application/x-www-form-urlencoded format used by HTML form submissions encodes a space as a plus sign instead. A plus sign inside a path segment therefore means a literal plus; inside a form-encoded query it means a space.

Which characters never need encoding?

The unreserved set: the letters A to Z in both cases, the digits 0 to 9, and the four marks hyphen, underscore, full stop and tilde. RFC 3986 guarantees these are safe everywhere in a URL and specifies that they should not be escaped, because percent-encoding them produces a different but equivalent URL that breaks string comparison and caching.

What causes a malformed URI error when decoding?

A percent sign not followed by two valid hexadecimal digits, such as a bare % in "100% free", or a percent-escape sequence that does not form valid UTF-8. Decoding rejects the whole string rather than guessing. Encoding a literal percent sign as %25 before it enters a URL avoids the problem entirely.

Should a URL be encoded twice?

Only when a complete URL is being carried inside another URL, such as a redirect target in a query parameter. In that case the inner URL is encoded once as a component, and its percent signs become %25 in the outer encoding. Accidental double encoding is a common bug, showing up as visible %2520 sequences in the address bar.

Sources

Last reviewed: · Formula and sources verified by Syed Aqeel Ahmad Gillani. See the methodology for how every calculation is derived.

Related tools