URL Encode / Decode
Percent-encode strings for URLs, or turn %20-riddled links back into readable text.
This URL encoder and decoder converts text to and from percent-encoding as you type. Encode a value before putting it in a query string, or paste a link full of %20, %3A and %2F to see what it really contains. Both directions update live.
Everything happens locally in your browser, so pasting URLs with session IDs, signed parameters or tracking tokens is safe: nothing is sent anywhere. That makes it a practical scratchpad for debugging redirect chains, OAuth callbacks and webhook URLs.
Percent-encoding exists because URLs only allow a limited character set. Spaces, ampersands, question marks and non-ASCII characters must be escaped as % followed by hex digits, otherwise they change the meaning of the URL. Encoding a value keeps it intact; forgetting to encode is how query strings break.
How to URL encode or decode
- Paste your text or URL into the input box.
- Pick Encode to escape special characters, or Decode to translate %XX sequences back.
- Read the live result in the output box.
- For query-string values, encode the value alone, not the whole URL, so & and = separators survive.
- Copy the output with one click.
Encode the value, not the whole URL
The most common mistake is running a complete URL through an encoder. That escapes the :// and every & separator, producing a link that no longer works. Encode only the parts that carry data, like an individual query parameter value or a path segment, then assemble the URL around them.
Also worth knowing: a space can appear as %20 or, in older query strings, as +. If a decoded string shows plus signs where spaces should be, that is legacy form-encoding rather than a bug.
What percent-encoding is for
URLs are allowed to contain only a limited set of characters: letters, digits, and a handful of punctuation marks. Everything else, including spaces, most symbols, and any non-ASCII character, has to be represented indirectly. Percent-encoding is that mechanism: each disallowed byte is written as a % sign followed by its two-digit hexadecimal value, so a space becomes %20 and a colon becomes %3A.
This matters because several characters are structural. A ? starts the query string, & separates parameters, = ties a key to its value, and / marks a path boundary. If a piece of your data happens to contain one of those characters, it must be encoded, otherwise the browser or server reads it as structure and the URL means something different from what you intended.
How encoding and decoding run in your browser
The tool converts in both directions the moment you type, using the browser's own encoding routines running as JavaScript on your device. Encoding walks your text, leaves the safe characters alone, and rewrites every other byte as its %XX form. Decoding scans for % sequences and turns each back into the original character.
Because this all happens locally, there is no round trip to a server and no waiting. It also means the tool keeps working offline once loaded, and, importantly, that whatever you paste stays on your machine. That is the whole reason to do this client-side rather than through a web service that would receive your links.
Privacy for links that carry tokens
Real URLs are often loaded with sensitive material: session IDs, signed query parameters, OAuth authorization codes, password-reset tokens, tracking identifiers, and pre-signed storage links that grant temporary access to private files. Pasting those into a tool that transmitted them would effectively leak working credentials to whoever runs the service.
Here nothing is uploaded, stored, or logged. Encoding and decoding happen only in your browser, so a signed callback URL or a magic-link you are debugging never leaves your device and vanishes when you close the tab. That makes the tool a safe scratchpad for inspecting redirect chains and authentication flows that you could not responsibly send anywhere else.
Common debugging jobs
Decoding is the fast way to read a hostile-looking link before you trust it: paste a URL full of %2F, %3A, and %3F, and the readable version reveals where it actually points and what parameters it carries. This is handy for auditing marketing links, checking a redirect target, or seeing what an OAuth provider is really sending back to your callback.
Encoding solves the opposite problem. When you build a URL by hand, for a test request, a deep link, or a documentation example, and a value contains spaces, ampersands, or non-English text, encoding that value first keeps it intact so the query string parses correctly. Getting this right is the difference between a link that works everywhere and one that breaks the moment someone shares it.
Reserved characters and the %20-versus-plus quirk
It helps to know which characters are reserved and why. Delimiters like / ? # [ ] @ ! $ & ' ( ) * + , ; = carry meaning in a URL, so encoding them changes whether they act as structure or as data. When a value must literally contain one of these, encode it; when it is meant to do its structural job, leave it alone. This is the crux of encoding the value and not the whole URL.
The other classic gotcha is the space. Modern percent-encoding writes a space as %20 anywhere in a URL, but the older application/x-www-form-urlencoded convention, still used in many query strings and HTML form submissions, writes it as +. Both decode to a space; if you see unexpected plus signs, you are almost certainly looking at legacy form-encoding rather than a corrupted link.
Related tools you might reach for next
A decoded URL frequently exposes other encodings nested inside it. A query parameter might carry a Base64 blob, which the Base64 decoder will open up, or a JSON string, which the JSON formatter will lay out neatly. Working through those layers one tool at a time is often how you unpick what a tracking or authentication link is really doing.
For lower-level curiosity, the binary translator shows how the very characters in a URL map to bytes, and the hash generator can fingerprint two links to check whether they are identical. Like this URL encoder and decoder, all of them run entirely in your browser, so you can pass sensitive strings between them without anything being uploaded.
Frequently asked questions
Is this URL encoder free?
Yes, entirely free. No account, no limits, no watermarks on anything. Use it as often as you like.
Is it private? My URLs contain tokens.
Yes. Encoding and decoding run in your browser only. The URLs you paste are never transmitted or stored, so signed links and session tokens stay on your machine.
What is the difference between %20 and + for spaces?
%20 is the standard percent-encoding for a space anywhere in a URL. The + form is an older convention specific to query strings (application/x-www-form-urlencoded). Both mean a space; %20 is the safer choice today.
Why did encoding break my URL?
You probably encoded the entire URL, which escapes the separators (/, ?, &, =) that give it structure. Encode only individual parameter values, then build the full URL from the encoded pieces.
Does it handle non-English characters?
Yes. Characters outside ASCII are encoded as UTF-8 percent sequences, so 'café' becomes caf%C3%A9 and decodes back correctly, including Arabic, Chinese and emoji.
Can I use it on my phone?
Yes. It works in any mobile browser on iPhone or Android, useful for checking a suspicious encoded link before you tap it.