Skip to main content
AllDevToolsHub
🔗

URL Encoder/Decoder

100% Local

Safely encode and decode URL parameters and strings.

URL Encoder/Decoder

Safe Web Transport

Encodes sensitive characters (like &, ?, =) into their URI-safe equivalents.

Try:
This tool runs entirely in your browser. Your input is never uploaded, logged, or sent to AllDevToolsHub or anyone else, and it keeps working offline once the page has loaded.

Paste a URL or query string. Encoded output appears instantly.

Learn More

Base64 Encoding: When You Should and Shouldn't Use It (2026 Guide)

Read Article
Overview

What is URL Encoder/Decoder?

Ensure URL parameters are correctly escaped for transport. Handles standard percent-encoding and decoding for sharing complex data in URLs or debugging.
FAQ

Frequently Asked Questions

Reference

Technical Deep Dive

URL Encoder/Decoder

Ensure your URL parameters are correctly escaped for transport. This tool handles standard percent-encoding and decoding, making it easy to share complex data in URLs or debug web requests.

encodeURIComponent and encodeURI are different. This page shows both so query values do not break the whole URL.

Encode a b&c=d as a query value. You should see spaces as %20 and & as %26. Decoding that string must round-trip.

Do not encode an entire URL with encodeURIComponent or you will break the scheme slashes.

01 Character Mapping Reference

Character Encoded (Hex) Role in URL Status
Space%20SeparatorMust Encode
&%26Param DelimiterMust Encode
?%3FQuery PrefixMust Encode
A-ZN/ALiteralSafe

02 Encoding Logic Pipeline

1
Normalization The input string is converted to a UTF-8 byte stream. This ensures multi-byte characters (emojis/non-Latin) are correctly represented.
2
Character Inspection Each byte is checked against the RFC 3986 'Unreserved' list. Letters, digits, and - . _ ~ are passed through.
3
Hex Conversion Reserved characters and non-ASCII bytes are replaced with a percent sign followed by their two-digit uppercase hex code.

03 When You Reach for URL Encoding

Percent-encoding shows up at every boundary where free-form text becomes part of a structured URL. Skip it in the wrong place and you get truncated query strings, broken OAuth callbacks, or full-blown injection bugs.

  • 🔎
    Query string parameter values A search term like cats & dogs must be encoded as cats%20%26%20dogs before being appended to ?q=. Otherwise the & terminates your parameter and the rest is parsed as a new key.
  • 🔁
    OAuth 2.0 redirect_uri values RFC 6749 says the redirect_uri parameter must be percent-encoded. https://app.example.com/cb?state=x becomes https%3A%2F%2Fapp.example.com%2Fcb%3Fstate%3Dx, providers do exact-match comparison, so even a missing colon encoding breaks the callback.
  • 📝
    application/x-www-form-urlencoded bodies HTML form POSTs use the same percent-encoding plus one wrinkle: spaces become + instead of %20. URLSearchParams in JavaScript and urllib.parse.urlencode in Python both follow this rule.
  • ⚠️
    Path segments with user content Building /users/{name}/posts from raw input lets a name containing / or .. change the route entirely. Encode each segment with encodeURIComponent, not the whole URL with encodeURI.
  • 🚫
    Encoding an already-encoded URL If %20 becomes %2520, the server sees a literal %20 in the path, not a space. Always know whether the value coming in has been encoded already, encoding twice is a real bug.

04 Worked Examples

EXAMPLE 1 · SPACE: + VS %20
Input string:
hello world
As a form body (application/x-www-form-urlencoded):
q=hello+world
As a path segment or generic URI component:
q=hello%20world

Most servers accept both in a query string, but it is application-defined. Express's req.query turns both back into a space; raw decodeURIComponent turns + into a literal +, not a space.

EXAMPLE 2 · RESERVED CHARS IN A SEGMENT
Username with reserved characters:
a/b?c#d@e
encodeURI (preserves URL syntax, wrong here):
a/b?c#d@e
encodeURIComponent (correct for path segments):
a%2Fb%3Fc%23d%40e

RFC 3986 §2.2 lists the reserved set: :/?#[]@!$&'()*+,;=. They have meaning at the URL level, so a value containing them must be percent-encoded, otherwise the parser splits the URL at the wrong place.

EXAMPLE 3 · DOUBLE-ENCODING BUG
Browser sends a redirect target:
?next=%2Fdashboard
Edge proxy "helpfully" re-encodes the value:
?next=%252Fdashboard
App decodes once, and ends up redirecting to:
%2Fdashboard   (treated as a literal filename)

The decoder ladder here is critical. Decode once at the framework boundary and never re-encode an already-encoded value. If you see %25 appearing in logs you almost certainly have a layer that is encoding twice.

05 Related Tools

URL encoding is rarely a destination, it is one stop on a debugging trip through proxies, redirects, and query strings.

🔗

URL Parser

Break a URL into scheme, host, path, and query parameters, useful when an encoded blob hides which part is malformed.
🔤

HTML Entity Converter

When a URL is embedded inside HTML, the & separators also need entity encoding, a common source of "missing parameter" bugs.
📦

Base64 Encoder

JWTs and OAuth state parameters often carry Base64URL, use this when the URL-encoded value contains an encoded token.
✓

Runs 100% in your browser

All processing happens locally. No data leaves your device, no telemetry, no logs, no server round-trips.

You Might Also Need

RJRahul JalavadiyaFounder & Lead Engineer
Last reviewed 2026-07-29