URL Encoder and Decoder

URL encoding writes each unsafe byte as % plus two hex digits

A URL can carry letters, digits and a small set of symbols as they are. Any other character is first turned into bytes, and each byte is written as % followed by two hexadecimal digits. This is called percent-encoding, or URL encoding. In UTF-8 the letter é takes two bytes, so it becomes %C3%A9, and a space becomes %20 (or + in a form submission). Decoding does the reverse: it turns each %XX back into a byte and reads the bytes as text.

The same text encodes differently depending on where it goes in a URL. A search term placed in one query value must also have &, =, / and ? encoded, while text that is already a full URL must keep those separators or the link stops working. This tool converts whichever box you edit, splits a URL into its parts and decodes each one, and recognizes values made on older Windows-1252 sites and values that were encoded twice. URL encoding is not encryption: anyone can reverse it.

When you need to encode or decode a URL

• A pasted link is full of % codes: a link such as /search?q=caf%C3%A9+near+me is hard to read in a chat or a document. Paste it into the encoded box and the search term and path appear as plain text.
• Putting a search term or product name into a link: an unencoded 'Tom & Jerry' makes everything after & a separate parameter, and the + in 'C++' is read as a space. Encode it with the Single value rule so it arrives as typed.
• Passing a return URL after login or checkout: the URL in redirect_uri or returnUrl must be encoded as a whole, or its own ? and & get mixed up with the outer URL.
• Building an API signature: OAuth 1.0 and AWS Signature Version 4 keep only RFC 3986 unreserved characters and write a space as %20. One different character and the signature check fails.
• Reading server logs and analytics: request paths and referrer URLs are stored encoded. To see which search term a visit came from, you have to decode it.
• Old PHP forms and shop pages: pages that were served as Windows-1252 (often declared as ISO-8859-1) encode 'café' as caf%E9, which a UTF-8 decoder cannot read.

How to use it

1. Decode: paste a URL or value with % codes into the encoded box on the right. The tool picks a rule from the shape of what you pasted (a URL gets Whole URL, a visible + gets Form +) and the decoded text appears in the plain text box.
2. Encode: type text in the plain text box and choose the rule that matches where it will go. Use Single value for a query value, file name or redirect target, Whole URL for a complete URL, Form + for the same output as an HTML form, and Strict for signatures.
3. Read the URL breakdown: when the text is a URL or a query string, the tool splits it into scheme, host, path, query values and fragment and decodes each. If a value contains another URL, 'Decode this URL' opens it. With several lines, it breaks down the line that has the cursor.
4. Character encoding: the default is auto-detect. When the bytes are not valid UTF-8, the tool reads them as EUC-KR, Shift_JIS or Windows-1252, whichever fits, and says which one it used. To encode for an older site, choose the encoding yourself.
5. Symbol map and function results: press a symbol to see how the four rules change it and why. The results by language and function show your text run through JavaScript, PHP and Python functions and mark the characters that differ from the current rule. Press a row to copy that result.

Four rules: what each one keeps

Each rule keeps a different set of symbols besides letters and digits. When another tool or your code gives a different result, this is almost always the reason.

The four characters Strict keeps are the RFC 3986 unreserved characters, so encoding them or not gives the same URL. Single value also keeps ! ' ( ) * because JavaScript follows the unreserved set of the older RFC 2396; the URL Standard defines this same set separately as its component set.

The Form + rule matches URLSearchParams. When a browser actually submits an HTML form, line breaks in a multi-line field are sent as %0D%0A, while this tool and URLSearchParams keep them as %0A (measured in Chromium 151).

Symbol by symbol

Here are the symbols people confuse most often and how each rule changes them. The Whole URL column shows the query position of an http or https URL. In the symbol map above the tool you can press all 35 symbols.

The Whole URL rule keeps % so that existing %XX codes survive. The cost is that a literal % has to be checked for two hex digits after it, so the tool reports how many such % characters it found. PHP urlencode() is close to the form rule but also changes * to %2A, and Python quote() is the Strict rule plus / kept.

%20 and +: how a space is read

Writing a space as + is the rule of HTML form submission (application/x-www-form-urlencoded). In a path, + is simply a plus sign. In a query, it can become a space or stay a plus depending on which function the receiving side uses to decode. Writing a real plus as %2B and a space as %20 gives the same meaning everywhere.

This tool reads + as a space only under the Form + rule. If you decode with Single value or Strict and a + remains, the status line offers a 'Read with Form + rule' button. The Whole URL rule keeps + to protect the structure, and the URL breakdown below decodes query values with the form rule.

Encoding a whole URL: encodeURI() versus the browser

encodeURI(), the usual choice for a complete URL, keeps the separators but also encodes % and does not treat the domain specially. A browser address bar follows the URL Standard: it uses a different set for the path, query and fragment, leaves existing %XX alone, and turns an international domain into Punycode. The Whole URL rule of this tool follows the browser.

As the last row shows, neither method can fix a URL that sits unencoded inside a value, because the outer URL reads y=2 as its own parameter. Encode the inner URL separately with Single value and attach it as next=https%3A%2F%2Fb.com%2F%3Fx%3D1%26y%3D2. When the Whole URL rule finds such a value, the status line warns you.

Double encoding and decoding one layer

Encoding text that is already encoded turns % into %25. So %20 becomes %2520; decoding once gives %20 again, and you must decode a second time to get the space. It usually happens when a framework or HTTP library encodes values for you and the code encodes them once more. RFC 3986 section 2.4 also says not to encode or decode the same text twice.

When the encoded box contains %25 followed by two hex digits, the tool guesses a double encoding and shows a 'Decode one more layer' button. The button changes only %25XX into %XX and leaves other separators alone. If the original text really contained the characters '%20', decoding another layer changes the meaning, so check where the value came from.

Older URLs encoded in Windows-1252

Current URLs are UTF-8 by default (RFC 3986 section 2.5), but older Western European sites, especially PHP and ASP forms served as ISO-8859-1, send form values as single bytes. 'é' is then %E9 instead of %C3%A9. Browsers treat the ISO-8859-1 label as Windows-1252 (Encoding Standard), which differs mainly in the range 0x80 to 0x9F, such as € at %80. The URL Standard also says that the query of an http or https URL is encoded with the page's character encoding, while the path is always UTF-8.

Decoding a Windows-1252 value as UTF-8 fails because a lone %E9 is not a valid UTF-8 sequence, and you get �. The auto-detect option of this tool first tries UTF-8 and, if that fails, reads the bytes as EUC-KR, Shift_JIS and Windows-1252 and keeps the reading with the most common characters. To build a value for an older site, choose Windows-1252 yourself. A character that does not exist in the chosen encoding (an emoji, for example) is written like a browser form does it: as &#number; encoded to %26%23number%3B.

International domain names become Punycode

A host name is never percent-encoded. Under the internationalized domain names rules (IDNA), a name with accented or non-Latin letters becomes an ASCII name that starts with xn-- (Punycode, RFC 3492). The Whole URL rule converts only the host this way, encodes the path and query as %XX, and shows the original characters again when you decode an xn-- name.

In code

// JavaScript
encodeURIComponent('café crème & C++');          // caf%C3%A9%20cr%C3%A8me%20%26%20C%2B%2B
decodeURIComponent('%C3%A9');                     // é (URIError on a bad %)
new URLSearchParams({ q: 'café near me' }).toString(); // q=caf%C3%A9+near+me
new URL('https://café.example/menu').href;        // https://xn--caf-dma.example/menu

# Python
from urllib.parse import quote, quote_plus, unquote, urlencode
quote('café crème', safe='')                      # caf%C3%A9%20cr%C3%A8me
quote_plus('café crème')                          # caf%C3%A9+cr%C3%A8me
unquote('%E9', encoding='cp1252')                 # é
urlencode({'q': 'café near me', 'page': 2})       # q=caf%C3%A9+near+me&page=2

// PHP
rawurlencode('café crème');   // caf%C3%A9%20cr%C3%A8me
urlencode('café crème');      // caf%C3%A9+cr%C3%A8me
http_build_query(['q' => 'café near me', 'page' => 2]);  // q=caf%C3%A9+near+me&page=2

// Java
URLEncoder.encode("café crème", StandardCharsets.UTF_8);          // caf%C3%A9+cr%C3%A8me
URLDecoder.decode("caf%C3%A9+cr%C3%A8me", StandardCharsets.UTF_8); // café crème

Form-rule functions (URLSearchParams, Python quote_plus(), PHP urlencode(), Java URLEncoder) write a space as +, so for a path segment or a signature use a function that produces %20.

Common mistakes

• Encoding a whole URL with the Single value rule: you get https%3A%2F%2F…, which does not open as a link. Use Whole URL to fix a URL itself, and Single value only when the URL becomes a value of another URL.
• Leaving & or # inside a value: 'A&B' delivers only A, and everything after # never reaches the server. Encode with Single value to get A%26B and %23.
• C++ arrives as 'C' and two spaces: the receiving side decodes with the form rule and the + was left as it is. Write C%2B%2B.
• A value shows up as %2520: a library already encoded it and the code encoded it again. Decide on one place where encoding happens.
• Decoding a Windows-1252 value as UTF-8: the text is garbled or shows �. Switch the character encoding to Windows-1252 and decode again.
• decodeURIComponent stops with an error: a value such as '100%' has no two hex digits after the %, which throws URIError. This tool leaves such a % as it is and shows its position.

Limits

• The tool only converts characters. It does not check that a URL opens or is safe, and it never connects to the address.
• The Whole URL rule applies only the URL Standard sets for each component. It does not do the other clean-up a browser performs, such as lowercasing the scheme and host, resolving ../, removing a default port or adding / to an empty path. Browsers also differ on a few symbols; Chrome 151, for example, encodes | in a path as %7C.
• URLs that are not http or https, such as mailto:, are also encoded with the path set. The URL Standard has its own rule for the opaque path of those URLs, so space handling can differ.
• Auto-detect is a guess. Short values and rare characters (extended CP949 characters, half-width kana in Japanese pages) can be read with the wrong encoding, so choose one yourself when the result looks wrong. Only EUC-KR, Shift_JIS and Windows-1252 are supported as legacy encodings, not EUC-JP or Big5.
• The URL breakdown only reads and copies. To edit or add query items, use the URL query ↔ parameter table tool. The results by language and function compare only the first 4,000 characters.

As of: encoding sets come from the URL Standard (version of October 19, 2026) and RFC 3986, signature rules from RFC 5849 and the AWS documentation, and function behavior from each language's documentation, all checked on October 22, 2026. The values in the tables gave the same results in this tool, PHP 8.5, Python 3.14, Node.js 26 and Chromium 151.

Sources

• 01WHATWG: URL Standard, Percent-encoded bytesFragment, query, special-query, path, userinfo, component and form sets; legacy encodings and &#number; handling
• 02WHATWG: application/x-www-form-urlencodedForm serializing (space to +) and parsing (+ to space)
• 03RFC 3986: Uniform Resource Identifier (URI): Generic Syntax2.1 uppercase hex, 2.2 reserved, 2.3 unreserved, 2.4 no double encoding, 2.5 UTF-8, Appendix B regular expression
• 04ECMAScript: URI Handling FunctionsDefinitions of encodeURI, encodeURIComponent and decodeURIComponent
• 05MDN: encodeURIComponent()Characters left as they are, URIError for a lone surrogate
• 06RFC 5849 3.6: OAuth 1.0 Percent EncodingKeep only unreserved characters, uppercase hex for the rest
• 07AWS: Create a signed AWS API requestUriEncode: unreserved characters only, space as %20, uppercase hex
• 08PHP: urlencodeEncodes everything except -_. and writes a space as +; rawurlencode follows RFC 3986
• 09Python: urllib.parse.quote_.-~ kept, safe defaults to '/', quote_plus writes a space as +
• 10Java: URLEncoder. - * _ kept, space as +, UTF-8 recommended
• 11RFC 3492: PunycodeThe xn-- names of internationalized domains
• 12WHATWG: Encoding StandardHow EUC-KR (with CP949), Shift_JIS and Windows-1252 are read

Frequently asked questions

Related tools