URL Decoder and Encoder

Encode and decode URLs and query strings in your browser, with the whole URL and single value modes explained.

Free, no limit Nothing uploaded Works offline No sign-up

Two modes, and picking the wrong one breaks the link

This is the thing that catches everyone. There are two levels of URL encoding and they are not interchangeable.

Encoding a single value escapes everything that has meaning in a URL, including the slash, the question mark, the ampersand and the equals sign. That is what you want for a search term or any value going into a query string, because a slash inside a value must not look like a path separator.

Encoding a whole URL leaves that structural punctuation alone and escapes only characters that cannot appear at all, such as spaces. That is what you want when you have a complete address that merely needs tidying up.

Use the first on a whole URL and you get an unusable string with the protocol slashes escaped. Use the second on a value containing an ampersand and the query string splits in the wrong place.

A URL with spaces and symbols being percent encoded

How to use it

Paste into the left box and the result appears in the right one as you type. Change any option and it recalculates immediately.

Copy puts the result on your clipboard and confirms it did. Download saves it as a file, which is the easier route when the output is long enough that selecting it by hand is a nuisance. Clear empties the boxes and puts the cursor back where you need it.

Where a sample button appears, it loads a small realistic example. It is there so you can see what the tool expects before pasting your own material, which is quicker than reading a description of the input format.

Keyboard and mobile

The text areas are ordinary form fields, so every shortcut your system already has works: select all, undo, redo, and paste without formatting. Tab moves between the panes and the controls in the order you would expect, and every control is reachable without a mouse.

On a phone the panes stack rather than sitting side by side, and the text areas grow to a comfortable height. Spellcheck and autocorrect are switched off in them, because a tool that silently capitalises your url encoder input is worse than useless.

If something looks wrong

When the result is not what you expected, the message under the boxes is the first thing to read. It reports what happened rather than a generic failure, so a malformed input names the line to look at and a successful run reports what it did, such as how many lines it kept or how many replacements it made.

A count of zero is informative in itself. It usually means the input did not contain what you thought it did, most often because of capitalisation or an invisible trailing space, both of which are far more common in pasted data than people expect.

Nothing is corrected silently. If the input cannot be handled, the output is left empty and the reason is stated, rather than a partial result being returned that looks plausible and is wrong. A tool that guesses is worse than one that says it could not.

What gets escaped and why

A URL reserves a small set of characters to mean something structural. Everything else is either safe or has to be escaped.

  • Space becomes %20, or a plus sign in the older form encoding used by HTML forms. Both are seen in the wild.
  • Ampersand becomes %26, otherwise it starts a new query parameter.
  • Equals becomes %3D, otherwise it splits a parameter into name and value.
  • Question mark becomes %3F, otherwise it begins the query string.
  • Hash becomes %23, otherwise everything after it is treated as a fragment and never reaches the server.
  • Non English characters are encoded as their UTF-8 bytes, so an accented letter becomes two percent sequences.

Which encoding for which job

The three encodings on this site solve different problems and are not interchangeable. Using the wrong one produces output that looks encoded and fails in a way that can take an afternoon to find.

EncodingUse it forEscapesGrows by
Base64Binary data in a text channelEverythingAbout 33 percent
Percent, URLValues inside a URLReserved charactersVaries
HTML entitiesText placed into markupFive charactersSlightly

Base64 is for bytes that are not text at all: an image in a data URI, a certificate in a PEM file, an attachment in an email. It is not for making text safe, and it protects nothing.

Percent encoding is for URLs specifically, and even within a URL the rules differ between a path segment and a query value. It exists because a URL reserves punctuation for structure, so a value containing that punctuation has to be escaped or the address means something else.

HTML entities are for text going into markup, so that a less than sign stays a less than sign instead of opening a tag. This is the encoding that stops user supplied text becoming executable, and it is applied at the moment of output, not when the data is stored.

The rule that avoids nearly every bug: encode at the boundary, once, for the destination the text is entering. Encoding early, or twice, is how you end up with visible entity codes and double escaped URLs in production.

Safe to use with real data

Most online developer tools post whatever you paste to a server. For a toy example that is fine. For the payload you are actually debugging, which is a production API response with customer records in it, an internal configuration file or a token, it is a data disclosure that nobody signed off.

Everything on this page runs in your browser. The parsing, the conversion and the formatting all happen in memory on your own machine. Nothing is transmitted, nothing is logged, and there is no server that could keep a copy even if someone asked it to.

You can check that yourself: open your browser's network panel, paste something in and watch nothing happen. Then disconnect from the internet and use the url encoder tool anyway, because once the page has loaded it does not need the network again.

That constraint also shapes what we will build. Anything that genuinely requires a server, such as looking up a value in a database, is not something we can offer honestly under these terms, so we do not offer it at all.

No limits, and no account

There is no cap on how much text you can run through this, no daily quota and no sign up wall at the point where it becomes useful. The URL Encoder tool costs us nothing to provide because it runs on your device rather than ours, so there is nothing to meter.

There is also nothing to install. It is one page of HTML, one stylesheet and one script, which together come to a fraction of the weight of a single photograph. It loads in well under a second on a phone connection and works immediately.

Why we built it this way

Developer tools that upload your input are a poor bargain. You get a conversion and they get your data, and the thing you pasted was usually the one piece of text you should have been most careful with. Running it locally removes the trade entirely.

The whole site is built on the same rule: if the work can be done in the browser, it is done in the browser. Over a hundred tools work that way, and the handful that genuinely cannot are the ones we have not built.

It also means the tool keeps working when we are not paying attention to it. There is no service to go down, no API key to expire and no rate limit to hit at the moment you need it most. The page you loaded is the whole program, and it will behave the same way in five years as it does today.

FAQ

URL Encoder

The questions people ask most about this tool.

Encoding a value escapes structural characters such as slash, ampersand and question mark. Encoding a whole URL leaves those alone. Use the first for query string values and the second for a complete address.

Plus comes from the older HTML form encoding and %20 from the URL standard. Both are decoded correctly by servers, and %20 is the safer choice in a path.

As their UTF-8 bytes, one percent sequence per byte. An accented letter usually becomes two sequences and an emoji four.

Because everything after an unescaped hash is treated as a fragment and never sent to the server. If a hash is part of a value, it must be encoded as %23.

Completely, with no account, no quota and no paid tier. It runs on your own device, so there is nothing for us to meter and nothing to charge for.

No. Everything happens inside this page, in memory on your machine. Nothing is transmitted, stored or logged, and you can confirm it by watching your browser's network panel while you type.

Yes. Once the page has loaded it never needs the network again, so you can disconnect and carry on working.

None that we impose. The practical limit is your device's memory, which on a modern machine is a very large amount of text.

Yes. The panes stack on a narrow screen and the controls stay reachable. Autocorrect is switched off in the input, so nothing is silently changed as you type.

Yes, freely and with no attribution required. What you paste is yours and so is what comes out.

Yes. An url decode online is this page under another name. There is one job here and several ways of asking for it.
More tools

Other developer tools

Same engine, different job. Every one runs in your browser.

All developer tools

JSON to CSV

Flatten nested JSON into a spreadsheet ready CSV.

CSV to JSON

Turn a CSV file into typed JSON records.

JSON to XML

Convert JSON documents into valid XML.

XML to JSON

Parse XML into clean, readable JSON.

JSON Formatter

Pretty print, minify and validate JSON.

YAML to JSON

Convert YAML config files into JSON.

JSON to YAML

Convert JSON into readable YAML.

Base64 Encoder

Encode and decode text or files as Base64.

Need a different conversion?

Over a hundred free tools, all running in your browser. Nothing is uploaded and nothing is capped.

Browse all tools Contact us