Use this URL encoder and decoder to encode text for a URL or decode percent-encoded text back to normal, choosing between encodeURIComponent, encodeURI and HTML form encoding where a space becomes +. If decoding fails, the tool shows where and why. A URL parser below splits any address into protocol, host, port, path and fragment, and lists each query parameter decoded. Everything runs in your browser.
Loading the tool… It runs in your browser and needs JavaScript.
Table of Contents
Which encoding to choose
- encodeURIComponent encodes everything except letters, digits and
- _ . ! ~ * ' ( ). Use it for a single query value or path segment, for example a search term or a file name. - encodeURI leaves the characters that give a URL its structure (
: / ? # & = + $ , ; @) alone. Use it on a whole URL that may contain spaces or non-ASCII letters. - Form encoding (
application/x-www-form-urlencoded) is what HTML forms and most POST bodies use. Spaces become+, and! ' ( ) ~are encoded too, as the WHATWG URL Standard requires.
All three encode text as UTF-8 first, so é becomes %C3%A9.
Decoding and common errors
Decoding reverses the chosen method. With encodeURIComponent a + stays a plus sign; choose form encoding when + stands for a space, as in query strings sent by forms. decodeURI deliberately leaves escapes of reserved characters such as %2F encoded.
- A
%that is not followed by two hex digits, as in100%, is reported with its position. Write a literal percent sign as%25. - An escape such as
%E9on its own is not valid UTF-8. It usually comes from an old system that used Latin-1; the tool names the sequence and its position.
Reading a URL with the parser
Paste a full URL into the parser to see the protocol, user name and password if present, host name, port (or the default port for the scheme), path in raw and decoded form, query string, fragment and origin. Each query parameter is listed in order, decoded the way a server reads it, including repeated names and empty values. If you leave out the scheme, https:// is assumed. International host names are shown in Punycode, the ASCII form DNS uses.
For server admins
Encoded URLs fill access logs, and decoding them makes attacks and broken links easier to read. From the shell:
python3 -c 'import sys,urllib.parse as u; print(u.unquote_plus(sys.argv[1]))' 'q=caf%C3%A9+menu'
curl -G --data-urlencode 'q=server admin & co' https://example.com/search
jq -rn --arg v 'a b&c' '$v|@uri'
URL Encoder at a glance



Related tools: Base64 Encoder and Decoder · curl Command Converter · HTTP Redirect Checker · JWT Decoder and Verifier.
Official documentation (checked 9 October 2026): RFC 3986: Uniform Resource Identifier (URI): Generic Syntax · WHATWG URL Standard · MDN: encodeURIComponent()
Frequently asked questions
What is the difference between %20 and + for a space?
Both mean a space, but + only does so in form-encoded data such as query strings from HTML forms. In a URL path, + is a literal plus sign, so %20 is the safe choice there.
Why does decoding fail with a malformed URI error?
Either a % is not followed by two hex digits, or the escapes do not form valid UTF-8, often because the text was encoded in Latin-1. The tool shows the exact position.
Should I encode a whole URL with encodeURIComponent?
No. It would encode the : / ? and & that the URL needs. Use encodeURI for a whole URL, or encode only the individual values with encodeURIComponent.