Emergency server help: get in touch

URL Encoder, Decoder and Parser

Encode and decode URL text three ways, and break any URL into host, port, path and decoded query parameters.

Where it runs
Runs in your browser
Last updated
October 9, 2026

Use this URL encoder and decoder to encode text for a URL or decode percent-encoded text back to normal, choosing between encodeURIComponent, encodeURI and HTML form encoding where a space becomes +. If decoding fails, the tool shows where and why. A URL parser below splits any address into protocol, host, port, path and fragment, and lists each query parameter decoded. Everything runs in your browser.

Loading the tool… It runs in your browser and needs JavaScript.

Which encoding to choose

  • encodeURIComponent encodes everything except letters, digits and - _ . ! ~ * ' ( ). Use it for a single query value or path segment, for example a search term or a file name.
  • encodeURI leaves the characters that give a URL its structure (: / ? # & = + $ , ; @) alone. Use it on a whole URL that may contain spaces or non-ASCII letters.
  • Form encoding (application/x-www-form-urlencoded) is what HTML forms and most POST bodies use. Spaces become +, and ! ' ( ) ~ are encoded too, as the WHATWG URL Standard requires.

All three encode text as UTF-8 first, so é becomes %C3%A9.

Decoding and common errors

Decoding reverses the chosen method. With encodeURIComponent a + stays a plus sign; choose form encoding when + stands for a space, as in query strings sent by forms. decodeURI deliberately leaves escapes of reserved characters such as %2F encoded.

  • A % that is not followed by two hex digits, as in 100%, is reported with its position. Write a literal percent sign as %25.
  • An escape such as %E9 on its own is not valid UTF-8. It usually comes from an old system that used Latin-1; the tool names the sequence and its position.

Reading a URL with the parser

Paste a full URL into the parser to see the protocol, user name and password if present, host name, port (or the default port for the scheme), path in raw and decoded form, query string, fragment and origin. Each query parameter is listed in order, decoded the way a server reads it, including repeated names and empty values. If you leave out the scheme, https:// is assumed. International host names are shown in Punycode, the ASCII form DNS uses.

For server admins

Encoded URLs fill access logs, and decoding them makes attacks and broken links easier to read. From the shell:

python3 -c 'import sys,urllib.parse as u; print(u.unquote_plus(sys.argv[1]))' 'q=caf%C3%A9+menu'
curl -G --data-urlencode 'q=server admin & co' https://example.com/search
jq -rn --arg v 'a b&c' '$v|@uri'

URL Encoder at a glance

URL Encoder – short answer
In short: Encode and decode URL text three ways, and break any URL into host, port, path and decoded query parameters.
URL Encoder – what this tool covers
URL Encoder: what this tool covers.
URL Encoder – questions answered
URL Encoder: the questions this tool answers.

Related tools: Base64 Encoder and Decoder · curl Command Converter · HTTP Redirect Checker · JWT Decoder and Verifier.

Official documentation (checked 9 October 2026): RFC 3986: Uniform Resource Identifier (URI): Generic Syntax · WHATWG URL Standard · MDN: encodeURIComponent()

Frequently asked questions

What is the difference between %20 and + for a space?

Both mean a space, but + only does so in form-encoded data such as query strings from HTML forms. In a URL path, + is a literal plus sign, so %20 is the safe choice there.

Why does decoding fail with a malformed URI error?

Either a % is not followed by two hex digits, or the escapes do not form valid UTF-8, often because the text was encoded in Latin-1. The tool shows the exact position.

Should I encode a whole URL with encodeURIComponent?

No. It would encode the : / ? and & that the URL needs. Use encodeURI for a whole URL, or encode only the individual values with encodeURIComponent.

Share this tool

Free website test

Is your website set up right?

Check SSL, security headers, redirects, robots.txt, sitemap, llms.txt and security.txt in one test. It takes about 30 seconds.