Security

URL Encoder and Decoder

Percent-encodes a value for a query string, or a whole URL, and decodes either direction back again.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the value or the URL.
  2. Choose "a single value" for something going into one query string parameter, or "a whole URL" for a complete address.
  3. Select Encode, or Decode to go the other way.
  4. Build a URL by encoding each value separately and then assembling, never by encoding the finished URL.

What url encoder does

There are two different jobs here and using the wrong one causes most URL encoding bugs. Encoding a whole URL leaves the characters that give it structure alone, so :, /, ? and & keep working. Encoding a single value escapes those too, because inside a query string parameter an unescaped & ends the parameter and an unescaped = splits it.

The rule is simple once stated: encode each parameter value on its own, then assemble the URL from the encoded pieces. Encoding the finished URL as a value breaks it, and encoding a value as a whole URL leaves an ampersand in a customer name to truncate your parameter. The decode direction also treats + as a space, which is how a submitted HTML form encodes one.

Frequently asked questions

Encoding a whole URL leaves : / ? & and # alone so the address still works. Encoding a value escapes those too, because inside a parameter an unescaped & ends the parameter early. Use value mode for parameters and whole-URL mode for a complete address.

Because it was not encoded as a value. A customer name such as "Smith & Jones" placed unencoded into a query string ends the parameter at the ampersand and starts a new one called "Jones". Encode each value separately, then assemble the URL.

Because that is how an HTML form encodes a space in a submitted query string, and most decoded URLs people paste here came from one. If your plus sign is a literal plus, it should have been sent as %2B.