Skip to content
WGX

URL Encoder & Decoder

Make text safe to put in a URL, and read an encoded one back.

Direction
What this is

Escapes everything structural, including / : ? & = and #. This is the right answer nearly always.

Three things are called "URL encoding"

This is the part other tools leave out, and it is the reason people arrive here with a bug. The three encodings disagree about the characters that matter most, and the wrong one fails quietly: the request succeeds and the value is wrong.

  • A value inside a URL. Everything structural is escaped — /, :, ?, &, =, #. This is what you want when you are putting something into a query parameter, which is nearly always.
  • A whole URL. Those same characters are left alone, because without them the URL stops being a URL. Use it only on an address that is already correct and merely contains a space or an accent.
  • A form field. As a value, except that a space becomes +. This is what a browser does when it submits a form, and it is the only place a + means a space.

The ampersand problem

The commonest failure has no error message. A value containing & goes into a query string unencoded, and from that point the server sees a new parameter: everything after the ampersand is silently lost from the value and silently appears somewhere else. Encoded as a value, it becomes %26 and arrives whole.

Why a space is sometimes %20 and sometimes +

Both are right, in their own context. Percent-encoding has no special treatment for the space, so it becomes %20. The older form encoding replaces it with +. The trap is decoding: turning every + into a space will corrupt any value that genuinely contained a plus sign — a phone number, a search for "C++", a Base64 string. This tool only does it when you say the text came from a form.

What %ZZ actually means

A % introduces exactly two hexadecimal digits. Anything else is not an escape at all — usually a literal percent sign that should have been written %25. Rather than passing the browser's URIError along, this page names the sequence and where it is.

Decoding a forty-character path with a dozen tracking parameters gives you one long line, which is no easier to read than what you started with. So paste the whole link and it is laid out instead: scheme, host, port, path and fragment, then every query parameter with its value decoded.

Three of those get a word beside them, because each is usually a bug rather than a detail:

  • encoded twice — the value still holds % escapes after one decode. It was encoded, put into the URL, and encoded again; this is the commonest reason a redirect link comes out broken.
  • repeated — the same parameter name appears more than once. One server takes the first, another the last, a third reads them as a list, so it is rarely deliberate.
  • A host written in Punycode (xn--), or a user name and password written into the link itself. The first is how a domain is made to look like another; the second puts a credential into every log the URL passes through.

A link with no scheme is read as https://, and the panel says that it supplied the scheme rather than found it.

Not the same as Base64

Percent-encoding keeps text readable and escapes only what would break; Base64 rewrites everything into a safe alphabet and costs about a third more. Use this for URLs and the Base64 Encoder & Decoder for bytes that have to travel as text.

Nothing is uploaded

Your browser does the work, and the test suite for this page inspects the requests the tool makes and fails if one of them could carry the text. URLs are full of session identifiers and search terms; they are not something to hand to a server for tidying.

Questions

How do I URL encode a string?

Paste it in and the encoded form appears as you type. First check what you are encoding: a value going inside a URL, a whole URL, or a form field. They give different answers for the same text, and choosing the wrong one is the usual reason an encoded value still breaks.

What is the difference between encodeURI and encodeURIComponent?

encodeURIComponent escapes everything structural, including / : ? & = and #. It is for a value that goes inside a URL. encodeURI leaves those characters alone because they give a URL its shape, so it is for encoding a whole URL that is otherwise already correct. If you are not sure, you want the value one.

Why is my space sometimes %20 and sometimes +?

Both are correct in their place. Percent-encoding writes a space as %20; the form encoding a browser uses when it submits a form writes it as +. A + inside a normal URL path or a JSON body is a plus sign, not a space, which is why this tool only treats it as a space when you say the text is a form field.

Why did my ampersand break the query string?

Because it was left unencoded. An & inside a value is indistinguishable from the & that separates one parameter from the next, so everything after it becomes a new parameter. Encoding the value as a value turns it into %26, and the whole thing arrives intact.

How do I see what is inside a long URL?

Paste the whole link into the box. Underneath the result its parts are listed — scheme, host, port, path, fragment — and every query parameter with its value decoded, so a tracking link reads as a table instead of one long line. A value that was encoded twice, a parameter name that appears more than once, a host written in Punycode and a password written into the link are each named.

What does %ZZ mean?

That it is not percent-encoding at all. A % must be followed by exactly two hexadecimal digits, so %ZZ is a literal percent sign that should itself have been encoded as %25. This page names the sequence and its position instead of reporting a URIError.

Is what I paste sent anywhere?

No. It is encoded and decoded in your browser. URLs routinely carry session identifiers, search terms and one-time tokens, none of which should be handed to a stranger to prettify.

  • Base64 Encoder & Decoder

    Turn text into Base64 and Base64 back into text.

  • JSON Formatter

    Make JSON readable, make it small, or find out exactly what is wrong with it.

  • QR Code Generator

    Turn text or a link into a QR code that encodes the content itself — no redirect, no expiry — and download it as SVG or PNG.