URL Encoder & Decoder
Percent-encoding that gets the space-versus-plus distinction right.
The rule: which characters are safe
RFC 3986 defines a small unreserved set that never needs escaping: A–Z, a–z, 0–9, and the four marks -, _, ., ~. Everything else must be percent-encoded as % followed by two uppercase hex digits derived from the byte's UTF-8 value. A space is byte 0x20, hence %20.
Reserved characters are reserved for a reason
Characters like /, ?, #, &, = and + carry structural meaning. / separates path segments, ? starts the query, # starts the fragment. If you put a literal / where you meant data — say a filename containing a slash, or a value containing & — the URL parser will split it somewhere you did not intend. Escaping is what tells the parser 'this is content, not syntax'.
Space: two different answers
| Context | Space becomes | Why |
|---|---|---|
| Path segment, path, fragment | %20 | The component rule has no + shortcut |
application/x-www-form-urlencoded query | + | HTML form encoding predates RFC 3986 and defines + as space |
| Any UTF-8 byte above ASCII | %E4-style triplets | Non-ASCII goes through UTF-8 first, so one Chinese character becomes three percent-triplets |
The classic bug: a value containing a literal + (an email alias, or Base64) is posted in a query string, the server decodes + as a space, and the value silently changes. Percent-encode the + as %2B when it is data.
Component mode versus whole-URL mode
- Component mode escapes everything except the unreserved set — correct when you are encoding a value that will be dropped into a URL, such as a search term or a callback address.
- Whole-URL mode leaves the structural characters
/,:,?,&,=,#intact so the URL still parses — correct when you are cleaning up an existing URL rather than building one.
Double-encoding, the silent corruption
If %20 is encoded a second time, % becomes %25 and the receiver sees the literal text %20 instead of a space. This is why values must be encoded exactly once, at the boundary where they leave your control — and why debugging 'the URL is correct in the browser but wrong in the API' so often ends here.
How to use it
- Paste the URL or the raw value.
- Pick component mode for a value, whole-URL mode for a complete address.
- Choose whether spaces should use
%20or+. - Copy the result — decoding runs the same panel in reverse.
Worth knowing
- Unreserved characters:
A–Z a–z 0–9 - _ . ~— 66 characters, never escaped. - Percent-encoding operates on bytes, so non-ASCII is UTF-8 encoded first.
+means space only inapplication/x-www-form-urlencodedbodies and queries.- RFC 3986 is the governing standard; RFC 1866 introduced form encoding.
Limitations
- Encoding a complete URL that already contains escaped characters, without care, causes double-encoding.
- This tool does not validate that the resulting URL is well formed or reachable.
- Percent-encoding is not a security control — decode before validating input on the server.
- Extremely long URLs may be rejected by browsers or CDNs regardless of encoding.
Frequently asked questions
Why does my URL turn `+` into a space?
+ means space. Percent-encode a literal plus as %2B to preserve it.What is the difference between encodeURI and encodeURIComponent?
encodeURIComponent escapes everything except the unreserved set, which is right for a single value. encodeURI leaves /, :, ?, &, =, # and friends alone, which is right for a whole URL. Choosing the wrong one is the most common URL bug in JavaScript.