Encode & Decode URL Online — Free Percent-Encoder Tool

Result appears here

Why URL encoding matters

URLs have a fixed grammar. Some characters mean something specific —? starts a query string, & separates parameters, # starts a fragment, / separates path segments, and a space ends the URL entirely in many contexts. If you drop raw user input into a URL, any of those characters in the input will be misinterpreted, breaking the link or worse — opening you up to injection bugs.

Percent-encoding (also called URL encoding) replaces those characters with their hex byte values prefixed by a %. So a space becomes%20, an ampersand becomes %26, and so on. The result is a URL that can be transmitted, parsed, and read back without any ambiguity.

encodeURI vs encodeURIComponent

JavaScript exposes two encoders. encodeURI assumes you're passing a complete URL and leaves URL-syntax characters (: / ? & # =) alone. encodeURIComponentassumes you're passing a single value to plug into a URL and escapes everything that isn't an unreserved character. As a rule, use encodeURIComponent for query parameter values, path segments, and form data; use encodeURI only for whole URLs you've built yourself. This tool uses encodeURIComponent.

Decoding edge cases

Decoding is mostly straightforward, but two things trip people up. First, a malformed escape (e.g. %ZZ) throws an error — this tool catches that and shows a friendly message. Second, double-encoded values (like %2520 instead of %20) only get peeled back one layer per decode pass; that's the spec, not a bug. If you see%20 in the output, run it through the decoder again.

Encoding is not encryption

URL encoding is a transport mechanism, not a security one. Anyone can decode the output instantly. Don't put secrets in a URL just because you encoded them — for that, use a server-side store and a short link. Speaking of which: try Sniplinks's free URL shortener if you want to hide a long, ugly, parameter-laden URL behind a clean 6-character link.