Online URL Encoder Decoder Tool

1. 1

   Choose Encode or Decode

   Encode turns characters that a URL cannot carry literally into percent-escape sequences. Decode reverses them back to plain text. The result updates as you type, so there is nothing to press for a single URL.

2. 2

   Pick an encoding profile

   Component suits one query value or path segment. Strict RFC 3986 also escapes ! ' ( ) * and is what OAuth 1.0 and AWS request signing require. Full URL keeps : / ? & = intact so a whole link stays navigable. Form matches what a browser sends when it submits a form.

3. 3

   Set the character set if the data is not UTF-8

   Leave this on UTF-8 unless you are working with a legacy system. A query string produced by an older stack may hold Windows-1252 or Shift_JIS bytes, and choosing the right set is what turns %E9 into the character it was meant to be instead of an error.

4. 4

   Copy, download, or send the result back through

   Copy puts the whole result on the clipboard, Download saves it as a text file, and Use output as input moves the result into the input box and flips the direction so you can check that it round-trips.

Every control below changes the bytes that come out, and each one exists because a real workflow needs it. Nothing here is gated — the choices are the same whether you are signed in or not.

Encode and decode

Encoding turns characters a URL cannot carry literally into percent-escapes. Decoding reverses them. The direction also decides which character sets are offered, because the two are not symmetrical: a browser can read many more legacy encodings than it can write.

The encoding profile

The profile is the set of characters left alone. This is the single most consequential choice on the page, and picking the wrong one produces output that looks right and is rejected by one particular server. The section below compares all four.

The character set

Leave this on UTF-8 unless you know otherwise. It decides which bytes the escapes stand for, and it is the difference between %E9 reading as an accented e and %E9 being an error. Note that this is separate from how a dropped file is read: a Windows-1252 file can legitimately contain UTF-8 escapes, and both settings are then correct at once.

Lenient decoding

On by default. A malformed escape leaves the surrounding text intact and is reported with its exact character position, instead of failing the whole string. Turn it off when you want a hard failure — for example when you are validating that a string is well-formed rather than trying to read it.

Repeat-decode passes

Decodes up to five times, stopping as soon as a pass changes nothing. The count reported back is the true depth of the encoding, not the setting, so a string that was only encoded once still reports one pass however high you set the control.

Plus as space

A plus sign means a space in form data and nowhere else. Applied per profile: in full-URL mode the substitution only happens after the first question mark, so a literal plus in a path survives. In component and form modes the whole string is treated as query-shaped, because it is.

Legacy %uXXXX escapes

Strings produced by the old JavaScript escape() function, and by several older Microsoft stacks, use %u followed by four hex digits for a non-ASCII character. The standard decoder rejects these outright. Turn this on to read them.

Line by line

Converts each line separately and puts its own line ending back. This is the setting for a list of links: encoding the whole file as one string would escape the newlines themselves and give you a single unusable line.

Trim surrounding whitespace

Off by default, and deliberately so. Whitespace is exactly the kind of character percent-encoding exists to preserve, so removing it silently would defeat the tool. Turn it on when you have copied a URL out of an email and picked up a stray newline.

Browsers, servers, and caches treat certain characters as structure — spaces, ampersands, hashes, and non-ASCII text all need escaping when they are data rather than syntax. A dedicated tool lets you see the exact string an HTTP client will send, before you ship the code that builds it.

Benefits of correct URL encoding

• Safe transmission — reserved characters in user content stop breaking parsers that split paths, queries, and fragments.
• Unicode support — UTF-8 bytes are represented as % sequences so international text survives plain-ASCII transports.
• Predictable APIs — aligning with RFC 3986 reduces mismatches between front-end code, mobile apps, and backend frameworks.
• Fewer 400 errors — properly encoded parameters are less likely to be rejected by strict gateways or reverse proxies.
• Easier debugging — compare a hand-built string with what the standard functions produce before you ship a hotfix.

Percent-encoding rewrites each byte that must not appear literally in a URL as %HH, where HH is hexadecimal. Which characters stay literal depends on whether you are protecting a whole URL or an individual component — and that is the only thing that separates the four profiles below.

From characters to bytes to escapes

• Characters become bytes first — text is converted to bytes in the chosen character set. In UTF-8 an accented e is two bytes and a Japanese character is three.
• Each byte is tested — a byte in the profile's safe set is written literally; everything else becomes % followed by two hex digits.
• Space is the special case — in form encoding a space becomes a plus sign rather than %20, which is the only place that substitution is correct.
• Decoding walks it backwards — escapes are collected into runs of bytes and decoded together, because one character is often several escapes in a row.

The four profiles differ only in which characters they leave alone, but that difference decides whether a signature verifies and whether a link still works. This is what each one keeps literal, and when to reach for it.

Component

Leaves letters, digits and - _ . ! ~ * ' ( ) alone. This matches the standard encodeURIComponent function, and it is the right default for a single query value, a form field or one path segment. Use it unless one of the three below describes your situation.

Strict RFC 3986

Leaves only letters, digits and - . _ ~ alone — the specification's unreserved set, and nothing more. The five extra characters that component mode keeps (! ' ( ) *) are escaped here. Reach for this when you are building an OAuth 1.0 signature base string or an AWS Signature Version 4 canonical request, both of which require the strict set. A mismatch here fails only when one of those five characters appears in the data, which makes it one of the harder bugs to reproduce.

Full URL

Keeps the delimiters that give a URL its shape — : / ? # & = + $ , ; @ — so a complete link stays navigable after encoding. Use it when you are cleaning up a whole URL rather than assembling one. Note that decoding is deliberately asymmetric in this mode: %2F stays as %2F, because turning it into a slash would add a path segment that was not there. The Also decode delimiters checkbox overrides that when you want plain text.

Form

Keeps only letters, digits and * - . _ , and writes a space as a plus sign. This is what a browser actually puts on the wire when it submits a form, and what URLSearchParams produces. It is worth knowing that this is not the only definition in circulation: Python's quote_plus escapes the asterisk and keeps the tilde, which is the reverse on both counts. This tool follows the current web standard, because that is what the receiving server was built against.

A percent-encoded string is a sequence of bytes, and which characters those bytes mean depends entirely on the encoding the system used. This is where UTF-8-only tools give up, and it is a large share of the real work.

Reading legacy data

Thirty-seven character sets are available for decoding, covering the single-byte families — Windows-1250 through 1258, the ISO-8859 series, KOI8-R and KOI8-U, the Mac sets and IBM866 — plus the multi-byte East Asian sets Shift_JIS, EUC-JP, ISO-2022-JP, EUC-KR, GBK, GB18030 and Big5. Anything produced by a PHP, ASP or Java stack before roughly 2010 is likely to need one of these.

Writing legacy data, and what is not possible

Twenty-eight sets are available for encoding: UTF-8 and every single-byte set above. The multi-byte East Asian sets are decode-only, and that limit is stated here rather than quietly ignored. A character the target set cannot represent is written as a numeric reference such as € rather than dropped or replaced with a question mark — which is precisely what a browser does when submitting a form on a legacy-encoded page, so the receiving server already knows how to read it.

Most tools in this category, and the standard decodeURIComponent function they are built on, treat a decode as all-or-nothing. One bad character and you get an error message instead of your data. These are the four things that actually go wrong, and how this tool handles each.

• A truncated escape — a % with fewer than two hex digits after it, usually because the URL was cut off by a log line or a text field. Lenient decoding leaves it alone and reports its position.
• Bytes that are not valid in the character set — %E9 on its own is not valid UTF-8. Either the data is in a legacy encoding — pick it from the list — or the string is genuinely damaged, in which case lenient mode marks the spot.
• Double encoding — %2520 where %20 was meant. Raise the repeat-decode passes; the parameter breakdown flags which specific parameters are affected.
• Legacy %uXXXX — not percent-encoding at all, but the output of the old escape() function. Turn on legacy escapes to read it.

Paste something that looks like a URL and a breakdown appears under the result: the scheme, host, port, path and fragment, then a table of every query parameter with its key and value decoded individually.

This exists because decoding a whole tracking URL in one go gives you an unreadable line, when the question you actually had was what one parameter contained. The table decodes each key and value on its own, and marks the ones that look double-encoded or contain a broken escape — in practice that is usually a single parameter, most often a redirect target, and finding it by eye in a link with fourteen parameters is the part that takes the time. The breakdown reports exactly the characters you pasted; it does not lowercase the host, drop a default port, or resolve .. segments, because a diagnostic that repairs its input has destroyed the evidence.

Small details — like plus signs in form posts versus true percent-encoding — trip up teams when frameworks disagree.

Quick reference

• Space is %20 in a query string, but a plus sign in an application/x-www-form-urlencoded body.
• Only unreserved characters (letters, digits, - . _ ~) may appear unencoded in strict component encoding.
• Double-encoding produces longer URLs and can confuse servers; %2520 is the signature to look for.
• The standard decoder throws on a % followed by incomplete hex, and returns nothing at all when it does.
• One Japanese character becomes nine characters of output, so an encoded string can be many times longer than the text.
• Internationalized domain names use Punycode in DNS; URL encoding handles the path and query, not the hostname conversion.

Best practices

Encode at the boundary where untrusted text becomes part of a URL, and decode once when you treat it as data again.

• Encode each query value individually instead of encoding the entire URL twice.
• Log raw user input separately from the encoded string when debugging analytics or redirects.
• Prefer HTTPS links when sharing encoded URLs that contain sensitive tokens.
• Validate decoded output before injecting it into HTML to avoid problems from malicious links.
• Unit-test both directions if your product supports deep-linking from email or SMS templates.

Ideal use cases

• Web development — build search filters, UTM parameters, and OAuth redirect URIs with confidence.
• API integration — match SDK behaviour when documentation references RFC 3986 percent-encoding.
• QA and support — reproduce customer URLs without guessing which characters were escaped.
• Documentation — show exact before-and-after examples for partner integrations.
• Migration scripts — compare legacy escaping rules with what modern clients produce.

A single URL is typed or pasted; a list of them arrives as a file. Both paths go through the same engine and meet the same limits.

Which files it opens

Plain text and text-shaped formats: .txt, .log, .csv, .tsv, .md, .json, .xml, .html, .yaml, .ini, .env, .sql, .har, the common source-code extensions, and .url internet shortcuts. Anything else is refused by name, with a link to the tool that does handle it — a PDF is pointed at the text extractor rather than silently ignored. The file picker only offers the formats that work, so you cannot pick a file and watch nothing happen.

Which text encodings it reads

UTF-8, UTF-8 with a byte-order mark, and UTF-16 in either byte order when the file carries a mark identifying it. A UTF-16 file with no mark is refused rather than guessed at, because the byte order is a coin flip and getting it wrong produces convincing nonsense rather than an error. Whatever the file arrived as, it leaves as, so a Windows CSV does not come back as something Excel opens wrongly.

What Free includes

Every encoding profile, every character set the device supports, lenient decoding, repeat-decoding, legacy escapes, line-by-line conversion and the parameter breakdown — plus one file at a time up to 10 MB, and unlimited pasting within the same size. No conversion feature is held back.

What Pro adds

A queue of up to twenty files, a single ZIP download for the whole batch, and the removal of the 10 MB ceiling — Pro is limited by what your device can hold rather than by a larger fixed number. The 10 MB free limit is set where it is because percent-encoding is the rare text operation whose output is bigger than its input: every byte can become three characters, so 10 MB in can be 31 million characters out.

Three things this tool deliberately does not do. Multi-byte East Asian character sets are available for decoding but not for encoding, because their tables cannot be derived in reverse from what a browser provides. Repeat-decoding stops at five passes, which is far beyond any encoding depth seen in practice. And the parameter breakdown reports the URL exactly as typed rather than normalising it, so it will happily show you a malformed URL — which is the point.

Measured in Chromium on the reference machine: a 100,000-character URL converts in under a millisecond, and a document at the 10 MB free limit converts in well under a second. Conversion happens as you type for anything up to about a quarter of a million characters; above that it moves off the interface thread so the page never stops responding.

• Base64 Encoder/Decoder
• Base64 Encoder
• Base64 Decoder
• All converters
• Hash Generator
• UUID Generator
• QR Code Generator
• JSON Formatter
• JSON Escape
• Text Splitter
• Text Trimmer
• CSV Escape Fixer
• All text tools
• All JSON tools