URL Encoder

URL Encoder is a free, browser-based tool for percent-encoding, decoding, and inspecting URLs. Percent-encoding (also called URL encoding) is the mechanism defined in the URL standard for representing characters that are not allowed to appear literally in a URL. Each such character is replaced by a % followed by two hexadecimal digits — for example a space becomes %20 and an ampersand becomes %26.

URLs are only allowed to contain a limited set of characters: letters, digits, and a handful of symbols. Everything else — spaces, non-English letters, punctuation, and characters that have a special meaning in a URL — must be escaped before it can travel safely across the wire. This tool handles that conversion in both directions, so you can prepare values for a link or read back an encoded one.

Because the encoding runs entirely in your browser, nothing you paste is ever sent to a server. That makes it safe to work with URLs that contain tokens, session identifiers, or other sensitive query parameters.

You could reach for encodeURIComponent in a browser console or a language-specific helper on the command line, but an online URL encoder removes the friction. Paste, click, and copy — no environment to set up and no risk of a shell mangling your input.

A good encoder also makes the two common scopes explicit. Encoding a whole URL must leave structural characters like :, /, ?, and # untouched, or you would break the address. Encoding a single component — a query value, a path segment, or a fragment — must escape those same characters, because inside a value they are data, not syntax. Mixing up these two modes is the single most common URL-encoding bug, and having them side by side makes the right choice obvious.

An online tool is also ideal for debugging. When an API returns a undefined or a link resolves to the wrong page, pasting the URL and decoding it reveals exactly what the receiving server saw — double-encoded values, stray spaces, or a + that should have been a %20.

Encoding is straightforward once you decide what you are encoding.

1. Paste the string into the input box.
2. Choose Encode to escape characters, or Decode to reverse it.
3. Select the scope — a full URL keeps its structure intact, while a component encodes reserved characters too.
4. Copy the result.

Decoding works the same way in reverse: paste an encoded string, choose Decode, and every %XX sequence is turned back into the character it represents. If a value looks like it still contains percent-escapes after one pass — such as %2520 — it was double-encoded, and you can decode it again to recover the original.

URL encoding shows up anywhere a value has to ride inside a URL:

• Query parameters — encoding a search term, an email address, or a redirect target so that &, =, and spaces do not break the query string.
• API requests — building request URLs by hand for curl, Postman, or a webhook where a parameter contains punctuation or non-ASCII text.
• Redirect and callback URLs — passing one URL as a parameter of another (a common OAuth pattern) requires encoding the inner URL as a single component.
• Sharing links — cleaning up a link with tracking parameters or reading what a shortened, encoded URL actually points to.
• Debugging — decoding a logged URL to see the exact bytes a server received.

For values that must survive as opaque blobs — binary data or JSON embedded in a URL — pair this with a Baseundefined step, and use a JSON Formatter to inspect any JSON you decode.

Encode components, not whole URLs, when the value is user data. If you are inserting one value into a query string, encode just that value so its reserved characters are escaped. Encoding the entire assembled URL would leave the value's & and = unescaped and corrupt the query.

Encode once. Applying encoding twice turns %20 into %2520. If a link looks garbled, decode it repeatedly until it stabilises to find out how many times it was encoded.

Know your space. In the path and most query strings a space is %20. In application/x-www-form-urlencoded form bodies a space is +. Decoders differ on how they treat +, so be explicit about which convention your target expects.

Do not encode structural characters inside a whole URL. The ://, /, ?, and # that define a URL's shape must stay literal, which is why full-URL mode leaves them alone.

Since everything happens locally in your browser, you can safely encode and decode URLs that carry access tokens or personal data without any of it leaving your machine.