URL Encoder & Decoder

Percent-encode text for URLs, or decode it back to readable form.

Runs entirely in your browser

0 characters
0 characters

Try an example:

What percent-encoding is for

URLs have a limited alphabet. Characters outside it — spaces, accented letters, emoji — and characters that mean something structurally — ?, &, =, /, # — have to be escaped so they travel as data rather than as syntax.

Percent-encoding replaces each unsafe byte with % followed by two hex digits. A space becomes %20; é becomes %C3%A9, because UTF-8 represents it as two bytes.

Component or full URL?

This is the distinction that trips people up, and picking the wrong one produces bugs that only appear for certain inputs.

Encode component escapes everything that isn’t unreserved, delimiters included. Use it for a single query value, path segment, or form field:

name=John Doe   →   name%3DJohn%20Doe

Encode full URL leaves :, /, ?, & and = alone so the address still functions, escaping only what’s never legal:

https://lardr.dev/search?q=hello world
→ https://lardr.dev/search?q=hello%20world

The rule of thumb: if you’re building a URL, encode each value as a component before you join them together. If you already have a complete URL and just want to make it legal, encode the full URL.

Unreserved characters

RFC 3986 guarantees these are never escaped:

A–Z  a–z  0–9  -  _  .  ~

Everything else is fair game. Older tooling sometimes also escapes ~, which is harmless but unnecessary under the current spec.

%20 versus +

Both can represent a space, and they come from different specifications:

  • %20 is percent-encoding, valid anywhere in a URL.
  • + means a space only inside application/x-www-form-urlencoded — HTML form bodies and, by convention, query strings.

Outside a form body, + is a literal plus sign. This tool always produces %20, which is correct in every context. If you’re hand-building a form body, convert afterwards.

Double encoding

Encoding an already-encoded string escapes the % itself:

a b  →  a%20b  →  a%2520b

%2520 in a URL is the classic signature of a value that went through an encoder twice — usually because a framework encoded it and then application code encoded it again. Decoding twice recovers the original, but the real fix is finding the duplicate call.