Quick answer: URL encoding, or percent-encoding, writes characters that are not allowed in a web address as a percent sign and two hex digits, so a space becomes %20 and é becomes %C3%A9. Use “encode text” for a single value such as a query parameter, and “encode a full URL” to keep the address structure. Decoding reverses it.
Web addresses can only contain a limited set of characters. Spaces, ampersands, accented letters and emoji have to be converted into a safe form, such as %20 for a space. This is called URL encoding or percent-encoding, and you meet it in query strings, form submissions, redirects and API requests.
Paste your text, pick a mode, and the result appears as you type. If your input is a full link with a query string, a table shows each parameter and its decoded value, which is handy for reading long tracking links.
Which mode should I use?
- Encode text (the same as JavaScript
encodeURIComponent) converts everything except letters, digits and- _ . ! ~ * ' ( ). Use it for a single value, such as a search term you are putting into a query string. - Encode a full URL (
encodeURI) keeps the characters that give a URL its structure, like: / ? # & =, and only encodes the rest. Use it when you have a whole address that contains spaces or accents. - Decode turns %XX sequences back into characters. Tick “treat + as a space” for data from HTML forms, where a plus sign stands for a space.
Non-English characters are encoded as UTF-8 bytes, so the letter é becomes %C3%A9. If a decode fails, the text usually has a stray % that is not followed by two hex digits. Encoding is not encryption. It is a formatting rule, and anyone can decode it.
A worked example
Example. The text a b&c=d/é encoded as a URL component becomes a%20b%26c%3Dd%2F%C3%A9: the space is %20, the ampersand is %26, the equals sign is %3D, the slash is %2F, and the letter é is two bytes, %C3%A9. Decoding reverses it.
Common percent-encodings
| Character | Encoded | Character | Encoded |
|---|---|---|---|
| space | %20 | ? | %3F |
| ! | %21 | @ | %40 |
| # | %23 | = | %3D |
| $ | %24 | + | %2B |
| & | %26 | / | %2F |
| % | %25 | : | %3A |
Reserved characters that have a meaning in a URL must be encoded when they are part of a value.
Common mistakes to avoid
- Encoding a whole URL as a single value. That also encodes the slashes and question marks that give the address its structure, so use the full-URL mode.
- Encoding twice. A % becomes %25, so already-encoded text turns into gibberish such as %2520.
- Treating a plus sign as a space everywhere. It means a space in HTML form data, but in the rest of a URL it is a real plus sign.
Go deeper: read our guide UTM Parameters Explained: Track Every Campaign.
Frequently asked questions
What is the difference between encodeURI and encodeURIComponent?
encodeURI is for a whole address and leaves characters like / ? & = alone. encodeURIComponent is for one piece, such as a parameter value, and encodes those characters too, so the value cannot break the structure of the URL.
Why does a space become %20 and sometimes +?
Both mean a space. %20 is the standard form in URLs. A plus sign is used for spaces in HTML form data. When decoding form data, tick the plus option.
Why does decoding say my text is invalid?
A % must be followed by two hexadecimal digits, like %20. A stray % (as in “50% off”) or a broken sequence cannot be decoded. Encode the % as %25 first.
Is URL encoding secure?
No. It is only a way of writing characters safely and gives no protection. Do not use it to hide passwords or other secrets.
People also search for this as: URL encode online, URL decode, percent encoding, encodeURIComponent online, encode URL parameters, decode %20.
Sources and further reading
- RFC 3986: Uniform Resource Identifier (URI): Generic Syntax
- MDN: encodeURIComponent()
- Percent-encoding (Wikipedia)
Formulas on this page are checked by automated tests against independent references. See how we test our tools.