How to use it
- 1Choose Encode or Decode, then type or paste your text – the result updates as you type.
- 2When encoding, pick the right kind: Component for a single value such as a search term, Full URL for a complete address, or Form data to write spaces as
+. - 3When decoding a query string or form data, turn on “Treat + as a space”. If the text contains a broken escape, the tool marks exactly where it is.
- 4To inspect a link, paste it into “Parse a URL” to see its host, port, path, fragment and every query parameter, decoded.
What is URL encoding?
A URL may only contain a limited set of ASCII characters. Everything else – spaces, accented letters, emoji and characters with a special meaning, such as &, =, ? or # – has to be percent-encoded: each byte of the character’s UTF-8 form is written as % followed by two hexadecimal digits. A space becomes %20, é becomes %C3%A9 and € becomes %E2%82%AC.
Encoding stops data from being mistaken for the structure of the URL. If a search term contains & and you leave it as it is, the server splits the term into two parameters; written as %26, it stays part of the value.
Component, full URL or form data?
Component encoding – JavaScript’s encodeURIComponent – encodes everything except letters, digits and - _ . ! ~ * ' ( ). Use it for each piece you put into a URL: a query value, a path segment, a redirect target.
Full URL encoding – encodeURI – leaves the characters that structure a URL, such as : / ? # & =, untouched and only encodes spaces, non-ASCII characters and unsafe symbols. Use it for a whole URL that is already put together correctly, never for single values.
Form encoding (application/x-www-form-urlencoded) is what browsers send when you submit an HTML form, and what URLSearchParams produces. It works like component encoding, except that spaces become +. That’s why + means a space in most query strings – and why a real plus sign has to be written as %2B.
Why decoding can fail
A % must always be followed by two hexadecimal digits. Text such as 100% sure isn’t valid percent-encoding: the percent sign itself should have been written as %25.
The bytes behind the escapes must also form valid UTF-8. caf%E9 is how older systems encoded “café” in Windows-1252 or ISO-8859-1 – in UTF-8, é is %C3%A9. The decoder marks the exact sequence that fails, so you can tell whether the text was cut off or encoded with another character set.
Questions and answers
What does %20 mean in a URL?
%20 is an encoded space. Spaces aren’t allowed in URLs, so they’re written as %20 – or as + in query strings and form data. Both decode to an ordinary space.
Should spaces be encoded as %20 or +?
In the path, always use %20. In the query string both work in practice, because servers decode form data with + as a space. %20 is safe everywhere, while + only means a space in query strings and form bodies.
What is the difference between encodeURI and encodeURIComponent?
encodeURIComponent also encodes reserved characters such as / ? & = #, so it’s right for individual values. encodeURI leaves them alone so that a complete URL keeps working. Using encodeURI on a query value is a common bug: an & inside the value then splits it into two parameters.
Why do I get a “URI malformed” error?
JavaScript’s decodeURIComponent throws it when a % isn’t followed by two hexadecimal digits, or when the escaped bytes aren’t valid UTF-8. Paste the text into the decoder above and it shows which sequence causes the error and at which position.
Which characters don’t need to be encoded in a URL?
Letters A–Z and a–z, digits 0–9 and - . _ ~ never need encoding. Reserved characters such as : / ? # [ ] @ ! $ & ' ( ) * + , ; = are allowed where they have their special meaning, but must be encoded when they are part of the data.