Encode and decode URLs at either whole-URL or component level, with a breakdown of query parameters so you can see exactly what a link carries.
Waiting for text
Component encoding escapes / ? & = and # — use it for one value inside a URL.
Paste a value to encode
A query parameter, a path segment or a whole address — pick the scope above to match.
URL Encoder / Decoder runs entirely on your device — signed links and tokens are never uploaded.
You’re on the Free plan. Compare plans
URLs may only contain a restricted set of characters, so everything else is written as a percent sign followed by the character's bytes in hexadecimal. A space becomes %20, an ampersand %26, and a character outside ASCII becomes one escape per UTF-8 byte.
The decision that matters is scope, and it is where most broken links come from. Encoding a component — one query value, one path segment — must escape / ? & = and #, because inside that value they are data rather than structure. Encoding a whole URL must leave those characters alone, because there they are the structure. The two are different operations, and applying the wrong one either breaks the address or corrupts the value inside it.
This tool makes the choice explicit rather than guessing, and says something when the choice looks wrong for what you pasted — a whole URL being component-encoded, or a value that already contains escapes being encoded a second time.
When the input is a recognisable URL, it is also broken into its parts, with every query parameter decoded and listed. That turns a long signed link into something you can actually read, and it flags parameters that are themselves encoded URLs.
Component encoding escapes / ? & = and #, so it is correct for one value that will sit inside a URL. Full-URL encoding preserves those characters because they define the address's structure, and only escapes things that are never legal, such as spaces. They correspond to encodeURIComponent and encodeURI.
Percent-encoding defines %20. The + convention comes from HTML form submissions, where application/x-www-form-urlencoded writes a space as +. Both appear in query strings, which is why decoding offers a switch for it.
It was encoded twice: %20 was itself encoded, turning the % into %25. Decode again to recover the original. The tool says so when it spots escapes left in the result.
A % must be followed by exactly two hexadecimal digits. If it is not — because the value was truncated, or because a literal percent sign was never escaped as %25 — the sequence is not decodable, and the tool points at the one that failed.
Yes. Characters outside ASCII are encoded as their UTF-8 bytes, one escape per byte, which is what every modern browser and server expects.
No. Everything runs in your browser. URLs routinely carry session tokens, signed storage links and password-reset parameters, so none of it leaves your device.
