URL Encoder Decoder

Escape a value for a URL, or decode an escaped one back into readable text.

Runs on your deviceDeveloperWorkingNo account needed

What this tool does

URL Encoder Decoder rewrites the characters a URL cannot carry literally as percent-escapes: a space becomes %20, an ampersand becomes %26, and an accented letter becomes the pair of escapes that spell out its UTF-8 bytes. Three rule sets are offered because percent encoding is not a single operation. Component escapes everything unsafe, the structural characters : / ? # & = included. Whole URL leaves that punctuation alone so a complete address survives the pass. Form data follows the component rules but writes a space as +, the way application/x-www-form-urlencoded does.

Decoding is deliberately blunter than encoding, and the asymmetry is worth understanding. Whichever rule set is selected, the decode pass expands every escape it meets, so %2F comes back as a slash and %3F as a question mark — reserved characters are not held back the way a partial decode would hold them. The one thing the rules change on this side is the form option, which turns + back into a space first. Anything that cannot be decoded is refused rather than patched over, though the refusal is coarser than it looks: only a % that is not followed by two hex digits is pinpointed, and the position counts from the start of its own line when lines are handled separately.

Treat each line separately is on by default, which means a pasted column of values is escaped one line at a time and the line breaks between them survive untouched. Switch it off when the newlines are part of the value itself and you want them written out as %0A. Either way the summary line reports the direction, the line count and the character count before and after, so a result that is far longer than you expected is visible immediately — with the option off the whole block counts as a single line, however many breaks it holds.

The work happens in this browser tab and the text is never transmitted, which matters when the thing being escaped is a signed callback URL or an API key riding in a query string. Three limits are worth knowing before trusting the output. Encoding a string that is already encoded escapes the percent signs themselves, so %20 turns into %2520 — decode first if you are unsure what you are holding. A decode failure anywhere stops the whole run and the message does not name the line it came from, so a broken escape in a long paste has to be hunted by hand. And the component rules leave ! ' ( ) * ~ unescaped, because the browser's encoder still works from the older RFC 2396 list of marks; RFC 3986 agrees only about ~, filing the other five as sub-delimiters a strict consumer may read as structure.

How to use it

  1. Paste the value and pick a direction. Encode turns readable text into escapes; Decode goes the other way. Load sample fills the box with a URL carrying a space, an ampersand and an accent.
  2. Choose the encoding rules. Component for a single value, Whole URL when the input is a complete address whose : / ? # & = must stay intact, Form data when a space has to become a + rather than %20.
  3. Decide how lines are handled. Treat each line separately escapes one line at a time and keeps the breaks. Turn it off to handle the whole block as one value, where a newline is written as %0A.
  4. Check the summary, then copy the result. It names the direction, the line count and the character count either side. A failed decode clears the output box and explains the reason: a stray % is given a position, while bytes that are not valid UTF-8 are refused without one.

Processing & privacy

Runs on your device. Your file is processed directly in this browser.

Common use cases

Putting a search term into a query string by hand

A value containing a space or an ampersand silently splits into two parameters. Component rules escape both so the whole phrase stays one value.

Reading an OAuth redirect

A redirect_uri or state parameter arrives fully escaped inside another URL. Decoding it shows where the flow actually returns to before you follow it.

Building a form-encoded body

application/x-www-form-urlencoded expects + for a space rather than %20, and the Form data rule produces exactly what a browser would have sent.

Escaping a list of values at once

Paste one per line with the per-line option on and each is escaped independently, ready to paste back into a script or a spreadsheet column.

Repairing a link with a space in the filename

Whole URL rules escape the space and leave the scheme, host and path separators as they are, so the address stays a working address.

Questions

Does the text leave this tab?
No. Percent encoding and decoding both run here using the browser's own URI functions, so the value never leaves the page. Pressing Encode or Decode makes no request at all, which is why the result still appears with the network disconnected.
Which encoding rule should I pick?
Component when you are escaping one value that will sit inside a larger URL, Whole URL when the input is already a complete address you do not want taken apart, and Form data when the receiving end reads a + as a space.
Why did decoding turn %2F into a slash?
Because decoding always expands every escape, including the reserved ones. There is no partial decode here that would leave %2F, %3F or %23 in place, so a path segment that deliberately contained an escaped slash will read as an extra path separator afterwards.
Why does re-encoding a URL produce %2520?
The percent sign is itself an unsafe character, so encoding an already-escaped string escapes it again: %20 becomes %2520. Decode the value back to plain text first, then encode once.
Why are some punctuation marks left alone?
The component and form rules escape nothing the browser's encoder spares: letters, digits, hyphen, underscore, full stop, tilde and the marks ! ' ( ) *. Tilde is unreserved under RFC 3986 and safe anywhere; the other five are sub-delimiters, so escape them by hand if the parser at the far end treats them as structure.
Why will %E9 not decode?
Escapes are read as UTF-8 bytes, and a lone %E9 is a Latin-1 e-acute from an older page rather than valid UTF-8. Rather than guess an encoding, the decode is refused — and that refusal carries no position, because the escape itself is well formed. Only a % followed by fewer than two hex digits is located for you.
Can it split a URL into its parts?
Not here — this tool only rewrites characters. URL Parser breaks an address into scheme, host, path and query, and Query String Parser lists the parameters as a table.

Related tools