URL Encode and Decode

How it works

Paste the text into the left pane; each line is handled separately, so a list of addresses goes through in one pass. Choose the direction first and then the scope — that second choice is what decides whether the result is correct. Component mode encodes a single value: colon, slash, question mark, ampersand and equals are all converted, because inside a value a slash is data rather than a path separator. Full-address mode treats what you gave it as a complete address and leaves those separators alone, converting only unsafe characters such as spaces and accented letters. Decoding keeps the same distinction. If a broken percent sequence turns up — %ZZ, or a half-finished %A at the end of a line — you are told which line and which character it sits on; a sequence that is well formed but does not spell a legal UTF-8 character is reported separately, because that is a different fault with a different cause. The result can be copied with one click or downloaded as a text file.

This tool is also known as url encode, url decode, percent encoding, url encoder decoder, encode url online, decode url string.

What is Percent-encoding?

Percent-encoding represents characters that cannot be written directly in an address as a percent sign followed by two hexadecimal digits: a space becomes %20, a question mark %3F. The address standard permits only a limited set of characters, because the rest either act as separators (/, ?, &, =) or are interpreted differently by different systems. The encoding is applied to bytes rather than to characters: the text is converted to UTF-8 first and each byte becomes its own sequence, which is why a two-byte letter produces two sequences and an encoded address looks longer than the text you started with.

What is Query string?

The query string is the part of an address after the question mark, and it carries parameters to the server in the pattern ?q=plan&page=2 — the ampersand separates parameters, the equals sign separates a name from its value. Because those two marks are structural, they must be encoded whenever they appear inside a value; otherwise the server reads one parameter as two and the search comes back empty. That is exactly why this tool offers two scopes: query values need component mode, while a whole address needs full-address mode.

What is the difference between component and full-address encoding?

Both apply the same percent-encoding; they part company over what happens to the separators. Component mode does not recognise addresses at all: it looks at the text and encodes every unsafe character including : / ? # & =, because that text is going to become PART of an address, and a slash inside it is data rather than a path separator. Full-address mode assumes what it was given is already an address, treats the separators as structure and preserves them, converting only unsafe characters such as spaces and accented letters. In practice: process a form value or a query parameter in component mode, and an address you already hold that needs repairing in full-address mode. Mixing them up either turns an address into unusable text or leaves a separator sitting in the middle of a value and splits your data.

The commonest mistake: encoding a whole address in component mode

Run a complete address through component mode and https://example.com/path becomes https%3A%2F%2Fexample.com%2Fpath. That output is not broken — it is simply no longer an address, it is a value that carries an address as text. Paste it into a browser bar and nothing opens.

The rule is short: are you encoding a PART of an address, or the WHOLE of it? Putting the search text city plan into a q parameter is component mode. Repairing an address you already have that happens to contain spaces is full-address mode.

Which characters change and which stay

In both modes letters, digits and the marks - _ . ! ~ * ' ( ) pass through untouched, and a space always becomes %20. Anything outside plain ASCII is converted to its UTF-8 bytes first and each byte gets its own percent sequence, which is why a single é comes out as %C3%A9 and one character can turn into two or three sequences. An encoded address looking far longer than you expected is normal, not a sign that something went wrong.

• Encoded in component mode: : / ? # [ ] @ ! $ & ' ( ) * + , ; = — that is, almost everything
• Kept in full-address mode: : / ? # [ ] @ & = + $ , ;
• If a query value itself contains & or =, component mode is mandatory; otherwise the server splits one parameter into two
• A file name with a slash in it belongs in component mode as well

What the browser shows is not what it sends

Modern browsers decode percent sequences in the address bar and display them as readable text, so example.com/café-menu looks clean even though the request that reached the server was encoded. Copy that link into an email or a chat message and the long encoded form usually reappears — the link has not changed, only what is being displayed.

Decoding is the quick way to understand why a link looks broken: paste the unreadable address in and read off which parameter carries what. Note that the domain part follows different rules — non-ASCII domains use a separate conversion called punycode, and this tool does not touch them.

URL percent encoding table: what each character becomes

The values below come from the address standard, RFC 3986, and they do not vary between tools or languages: a character is written as a percent sign followed by two hexadecimal digits giving its UTF-8 value. A space becomes %20 because an address has no room for a space at all; the rest are encoded because they do structural work — an ampersand left raw inside a query value tells the server that a new parameter starts there.

These are the results component mode produces. In full-address mode the same characters are left alone, because there they build the structure of the address rather than sit inside a value; the section above covers which mode belongs where. Letters, digits and four marks — hyphen, period, underscore, tilde — are "unreserved" in the standard and are never encoded in either mode.

So the table is a checklist rather than something to memorise: when a link arrives broken, read down it to find which character was left unencoded or decoded wrongly.

• space → %20
• ! → %21
• " (double quote) → %22
• # → %23
• $ → %24
• % (the percent sign itself) → %25
• & → %26
• ' (apostrophe) → %27
• ( → %28 and ) → %29
• * → %2A
• + → %2B
• , (comma) → %2C
• / → %2F
• : → %3A
• ; → %3B
• = → %3D
• ? → %3F
• @ → %40
• [ → %5B and ] → %5D
• line break → %0A, tab → %09
• Never encoded: A-Z, a-z, 0-9 and four marks — hyphen ( - ), period ( . ), underscore ( _ ), tilde ( ~ )
• Accented letters take two bytes and so produce two sequences: é → %C3%A9, ü → %C3%BC, ñ → %C3%B1

Frequently asked questions

Should a space be %20 or a plus sign?

In the path part of an address a space is always %20. The plus sign counts as a space only in the query string an HTML form submits, which is an old convention from that one context. This tool produces %20 in both modes, because %20 is read correctly everywhere.

Can an address contain accented or non-English letters?

Yes, in the path and the query, where they travel as UTF-8 bytes written out as percent sequences. The domain name works differently: there a separate conversion called punycode applies, and this tool leaves domains untouched.

What happens if I encode an address twice?

The percent sign itself gets encoded, so %20 becomes %2520. This is the classic cause of a broken link. When you are not sure, run the decode direction first: if the output still contains percent sequences, the text was encoded twice.

Are the addresses I paste sent anywhere?

No. Encoding and decoding both run inside your browser, so even an address carrying a session token or private parameters never leaves this page.

How is the percent sign itself encoded?

As %25. That is not an exception but the point of the rule: the percent sign introduces an escape sequence, so wherever it appears as ordinary text it has to be encoded, or the two characters after it get mistaken for hexadecimal digits. Decoding reverses it: a %25 sequence comes back as a single percent sign.