A value inside a query string
- Input
- a/b?c=d
- Output
- a%2Fb%3Fc%3Dd
Component mode escapes the slash, question mark and equals sign. Without this, everything after the first ampersand becomes a separate parameter and your value is truncated.
URL Encoder and Decoder
URL encoding replaces characters that have a special meaning in a web address with a percent sign and their byte value, so a value containing a slash or an ampersand does not break the URL around it. The part most tools leave out is that there are two different jobs here — escaping a whole URL and escaping one value inside it — and using the wrong one is the usual cause of a link that silently loses half its parameters.
Runs entirely in your browser — nothing you paste is uploaded.
How to
How to use the URL Encoder
- 1
Decide what you are encoding
Choose component for a single value, full URL to escape an address while keeping its structure, or form for data sent as application/x-www-form-urlencoded.
- 2
Paste the text
Enter the value or URL. The result appears as you type, and switching modes updates it immediately so you can compare.
- 3
Check the breakdown
When the input parses as a URL, its scheme, host, path, query parameters and fragment are listed separately so you can see which part needs escaping.
- 4
Copy the result
Copy the encoded or decoded text. Decoding reports malformed sequences rather than silently returning something wrong.
Examples
URL Encoder examples
A whole address
- Input
- http://x.com/a b
- Output
- http://x.com/a%20b
Full-URL mode escapes the space but leaves the scheme, slashes and colon intact. Component mode would escape those too and produce a string no browser could follow.
Form-encoded data
- Input
- hello world
- Output
- hello+world
HTML forms encode a space as a plus sign rather than %20, and escape a few punctuation characters that percent-encoding leaves alone. Decoding form data with the wrong mode leaves stray plus signs in your text.
Why use it
What the URL Encoder gives you
Explains the mode you need
Each mode says what it escapes and when to use it, which is the actual difficulty — the encoding itself is trivial once you have chosen correctly.
Shows the URL's structure
Query parameters are listed as key and value pairs, so you can see exactly which value contains the character causing trouble.
Handles any script
Non-ASCII characters are encoded as their UTF-8 bytes, which is what every modern server expects.
Useful decode errors
A stray percent sign produces a clear explanation rather than an unhandled exception, which is how most decoders fail.
Good to know
URL Encoder limitations
- Encoding a URL twice produces a valid but wrong result — %20 becomes %2520. The tool cannot tell whether input is already encoded.
- Internationalised domain names use Punycode rather than percent-encoding, which this tool does not convert.
- Form mode assumes UTF-8. A legacy endpoint expecting another character set will need different handling.
- The structural breakdown only appears for input that parses as an absolute URL.
Summary
URL Encoder in short
- Use component mode for a single value and full-URL mode for a whole address.
- Component mode escapes slashes and ampersands; full-URL mode deliberately does not.
- Form encoding uses a plus sign for a space, which percent-encoding does not.
- Double-encoding turns %20 into %2520 and is the most common cause of broken links.
- Everything runs in your browser.
FAQ
URL Encoder questions
Should I escape the whole URL or just one value?
Escape the individual value. A whole URL needs its slashes, question mark and ampersands intact to work, so escaping it wholesale breaks it. Full-URL mode exists only for fixing an address that contains spaces or accents in its path.
Why does my link contain %2520?
It has been encoded twice. The first pass turned a space into %20, and the second turned the percent sign of %20 into %25. Decode it twice to recover the original, then encode only once.
Why is a space sometimes a plus sign and sometimes %20?
HTML form submissions use application/x-www-form-urlencoded, where a space is a plus. Everywhere else in a URL a space is %20. Decoding form data as ordinary percent-encoding leaves plus signs scattered through the text.
Which characters actually need encoding?
Anything outside letters, digits and the four characters hyphen, underscore, full stop and tilde. In practice the ones that cause real trouble are the space, ampersand, question mark, equals sign, hash and slash, because each already means something in a URL.
How are accented and non-Latin characters encoded?
As their UTF-8 bytes, each written as a percent sign and two hex digits. An é becomes %C3%A9 — two bytes, so two escapes. Any server following the modern standard decodes that back correctly.
Why does everything after a hash disappear?
The fragment after a hash is never sent to the server; it is handled by the browser alone. If a value in your query string contains a hash it must be escaped as %23, or the rest of the URL is treated as a fragment and lost.
Can the tool tell if my text is already encoded?
Not reliably, because %20 is a legitimate literal string as well as an encoded space. If your input already contains percent escapes, decode first and check the result looks right before encoding again.
Why are some punctuation marks left alone?
Hyphen, underscore, full stop and tilde are unreserved in the URL standard and never need escaping. Form mode additionally escapes exclamation mark, apostrophe, brackets and asterisk, which percent-encoding leaves as they are.
Do the URLs I paste get logged?
No. Encoding happens in your browser and nothing is sent anywhere, which matters because URLs frequently contain session tokens, API keys and customer identifiers in their query strings.
Discover
Related developer tools
Base64 EncoderEncode and decode Base64 in your browser. Handles emoji and accented text correctly, with URL-safe output and clear errors.JSON ViewerFormat, validate and explore JSON in your browser. Reports the line and column of an error and flags numbers too large to survive.Hash GeneratorGenerate SHA-256, SHA-1, SHA-512 and MD5 hashes from text or a file, and verify a checksum. Runs in your browser.UUID GeneratorGenerate cryptographically random v4 UUIDs or time-sortable v7 UUIDs in bulk, and inspect any UUID's version and variant.