URL Encoder and Decoder Online
Encode a value for safe use in a query string, or decode one back. Correct choice between component and path encoding matters more than it looks.
How it works
There are two different encodings and picking the wrong one produces broken URLs. Component encoding is for a single query-string value and escapes everything that is not unreserved, including slashes. Path encoding preserves slashes so a path stays a path. Using component encoding on a path turns /users/1 into %2Fusers%2F1, which most servers will not route correctly.
The characters that genuinely matter to escape are the ones that delimit structure: &, =, ?, #, and /. A value containing any of them, left unescaped, will be parsed as structure rather than data — a classic parameter-injection bug. encodeURIComponent escapes all of these, which is why it is the right default for query values.
Spaces are encoded as %20 by encodeURIComponent. In a query string, + is the traditional encoding for a space and is widely accepted; some older systems require it. If you are posting a form with the default enctype, use application/x-www-form-urlencoded and expect +.
Decoding is the reverse. Malformed input, such as a percent sign not followed by two hex digits, is reported as an error rather than silently passing through, because silently passing through malformed encoding is how double-encoding bugs survive.
Everything runs in the browser. URLs frequently contain session tokens, signed parameters, or internal hostnames, so there is no reason to send them anywhere to be escaped.
Use the URL Encoder and Decoder
Paste text on the left to see the result.Runs entirely in your browser — nothing you paste is uploaded or logged.
Worked examples
Real input and the exact output this page produces.
Example 1
Text
a=1&b=2
URL-encoded
a%3D1%26b%3D2
Frequently asked questions
When should I use path encoding instead?
When the value belongs in a path segment and should keep its slashes, such as an organisation name that legitimately contains one. Everywhere else, component encoding is correct.
Why are spaces encoded as %20?
That is what encodeURIComponent does and it is correct in a query string. The plus sign is a legacy convention from HTML form submission, still widely accepted.
Can I undo the encoding?
Yes, use the URL decoder tool on this site, or any decodeURIComponent call. Malformed input is reported rather than silently ignored.
Related tools
Others doing similar work.