← ALL TOOLS
// ENCODING · BROWSER

URL Encoder/Decoder

Percent-encode text for URLs and query strings, or decode an encoded string.

ENCODING · IN YOUR BROWSER

Runs in your browser; nothing you type leaves this page. Too long to share as a link.

HISTORY

Your last 5 runs appear here for 7 days, on this device only.

RESULT

Fill in the form and run the tool; the result appears here.

URL Encoder/Decoder percent-encodes a string so it is safe to place inside a URL (a query string value or a path segment), or decodes a percent-encoded string back to plain text. It runs in your browser.

How to read the result

The output shows the encoded or decoded value. This tool encodes a single component, the way JavaScript's encodeURIComponent does, so structural characters such as /, :, ? and & are escaped too. Paste a value, not a whole URL: encoding a complete URL this way breaks it. Decoding reports an error when a % is not followed by two hex digits or the bytes are not valid UTF-8.

Defender tips

  • Encode user-supplied values server-side before placing them in a URL you construct, even if the browser or a library also does it; do not assume client-side encoding alone is enough.
  • Watch for double-encoding bugs, where a value gets encoded twice and a filter or validator decodes it only once; this class of inconsistency is a known way to smuggle payloads past a WAF or input filter.
  • Decode and inspect query parameters during a review rather than trusting how they render in a browser address bar, which often decodes for readability and can hide what was actually sent.

FAQ

Which characters get encoded?

Everything except letters, digits and - _ . ! ~ * ' ( ) is percent-encoded, including /, ?, #, & and spaces (as %20). Characters outside ASCII are encoded as their UTF-8 bytes.

What is the difference between encoding a component and a full URI?

Component encoding (encodeURIComponent in JavaScript) escapes everything not in the unreserved set, including / and &; full-URI encoding leaves structural characters alone so the URL still parses as a URL.

Is percent-encoding reversible?

Yes, fully. Decoding recovers the exact original string with no loss. One catch: a + stays a + here, although HTML forms use it for a space in query strings.