About this tool
This tool percent-encodes text so it can be carried safely in a URL, and decodes percent-encoded strings back into readable text. It uses the browser's encodeURIComponent and decodeURIComponent, which escape everything that is not an unreserved character.
Query strings break in quiet ways. An unescaped ampersand splits one parameter into two, a raw fragment marker truncates everything after it, and a plus sign may be read as a space depending on the receiver. Encoding a value first removes that ambiguity, and decoding is just as useful when reading web server logs, OAuth redirect URIs or SAML relay states. Processing is client-side, so nothing you paste leaves the browser.
How to use it
Work on one value at a time rather than on a whole URL.
- Paste the raw value — a search term, a redirect target, or a JSON blob destined for a query parameter.
- Select Encode for the percent-encoded form, or Decode to see what an encoded string actually contains.
- Encode the value, not the entire URL: encoding a whole URL escapes the scheme separator and the question mark too.
- If decoding reports an invalid string, look for a stray percent sign not followed by two hex digits. To convert binary-safe text instead, see the Base64 encoder and decoder.
Common questions
Should I encode the whole URL or just the parameter values?
Just the values. encodeURIComponent escapes reserved characters the URL structure needs, such as the slash, colon, question mark and ampersand. Encode each parameter value individually, then assemble the URL around them.
Why is a space sometimes %20 and sometimes a plus sign?
%20 is the correct percent-encoding for a space anywhere in a URL. The plus convention comes from HTML form submission and is only valid in the query string. This tool produces %20; substitute it if the receiver expects form encoding.
Does encoding make a URL safe or private?
No. Percent-encoding only makes characters legal in a URL. The values remain plainly readable, and full URLs are routinely written to proxy logs, browser history and referrer headers, so never put secrets in them.