URL Encoder & Decoder
This URL encoder percent-encodes text for URLs and decodes it back — UTF-8 safe, with encodeURI vs encodeURIComponent, + for spaces, and an HTML entity mode.
URL encoding — also called percent-encoding — rewrites characters that would otherwise break a URL, such as spaces, ampersands and non-ASCII letters, as a percent sign followed by their hexadecimal byte value (a space becomes %20). Type your text and press Encode, or paste an encoded string and press Decode. By default the tool uses encodeURIComponent, which is right for a single query value or path segment; tick Whole URL to switch to encodeURI, which preserves the : / ? # & = that separate the parts of a complete URL. The + for spaces option produces and reads the application/x-www-form-urlencoded form used by HTML forms, and switching to HTML entities mode escapes & < > " ' for safe embedding in markup. Encoding is UTF-8 safe, so accents and emoji survive the round trip, and everything runs in your browser — nothing you type is uploaded.
Frequently Asked Questions
What is URL encoding (percent-encoding)?
URL encoding, also called percent-encoding, is the mechanism defined in RFC 3986 for representing characters in a URL that are either reserved (they have a structural meaning, such as / ? # & = : and space) or not allowed at all. Each such character is replaced by a percent sign followed by the two-digit hexadecimal value of its byte — a space becomes %20, an ampersand becomes %26, and so on. This lets you safely place arbitrary text into a query string, path segment, or fragment without breaking the URL structure. Decoding reverses the process, turning %20 back into a space. This tool percent-encodes the text you type and decodes percent-encoded text back to readable characters, entirely in your browser.
What is the difference between encodeURI and encodeURIComponent?
Both encode text for use in URLs, but they protect different characters. encodeURIComponent is for a single piece of a URL — one query value, one path segment — so it encodes the reserved characters that separate parts of a URL, including / ? : @ & = + $ # and the comma. encodeURI is for encoding a whole, already-assembled URL, so it deliberately leaves those separators intact and only encodes characters that are never legal anywhere in a URL, such as spaces and most non-ASCII letters. Rule of thumb: use component encoding (the default here) when you are building one value to drop into a URL, and whole-URL encoding (tick the box) when you have a complete URL that just needs its illegal characters cleaned up without breaking its slashes and question marks.
Why is a space sometimes %20 and sometimes +?
A space becomes %20 or + depending on which part of the URL and which encoding rules apply. In the generic percent-encoding of RFC 3986, a space is always %20, and that is what encodeURIComponent produces. But HTML form submissions use a slightly different scheme called application/x-www-form-urlencoded, where a space is encoded as a plus sign (+) instead. Both appear in the wild: many query strings written by web forms use +, while URLs assembled by code usually use %20. This tool defaults to %20, but ticking "Use + for spaces (form encoding)" switches the output to the form style and makes decoding treat + as a space, so you can round-trip either convention correctly.
Does it handle UTF-8 and emoji?
Yes — this URL encoder handles UTF-8 and emoji. JavaScript's built-in encodeURIComponent and encodeURI functions already encode text as UTF-8 before percent-encoding, so characters outside plain ASCII are represented as multiple percent-encoded bytes. That means accented letters like é and ñ, scripts like 漢字, and emoji like 🚀 all encode and decode correctly: encode them and decode the result and you get back exactly what you started with. Decoding reassembles the UTF-8 byte sequences into the original characters. If you ever see an error while decoding, it usually means the input contains a malformed percent sequence, such as a lone % or an incomplete %E2 that is missing its following bytes.
Is my data private?
Yes — your data stays private on your device. Everything happens locally in your browser using built-in JavaScript — the text you type and the encoded strings you paste are never sent to a server, logged, or stored. There is no account, no sign-up, and no tracking of the values you convert, so it is safe to use for query strings, tokens embedded in URLs, or any data you would rather not upload to a random website. Because the work is local, the tool also keeps working offline once the page has loaded.