Encoding and security

URL Encode and Decode Online

Percent-encode text for URLs or decode %XX sequences back to readable text, with every query parameter laid out for inspection.

  • Free foreverNo trial, no paywall, no usage limits.
  • No sign-upOpen the page and start. We never ask for an email to use a tool.
  • PrivateEverything runs in your browser. Your input is never uploaded or stored on our servers.
  • Works offlineOnce the page has loaded, the tool keeps working without a connection.
Turn text into a URL-safe string (spaces become %20).Turn %XX sequences back into readable text.
encodeURIComponent: for one query value or path segment. Escapes / ? & = # too.encodeURI: for a complete URL. Keeps / ? & = # so the link still works.
Form encoding (application/x-www-form-urlencoded): HTML forms send spaces as + instead of %20.

Text to encode

Clear

Encoded result

Use result as inputCopyDownload encoded.txt
Results update as you type. Nothing leaves your browser.

Need a secure web app built around this? Talk to our team

Quick answer

URL encoding (percent-encoding) replaces characters that are unsafe in a URL with a % followed by two hex digits, so a space becomes %20 and é becomes %C3%A9. In Playxoft's URL encoder, paste your text, pick Encode or Decode, and choose Value for a single query value or Whole URL to keep the link's structure intact.

  • Encode and decode
  • Value or whole-URL scope
  • Form + spaces
  • Query parameter table
  • Error location
  • Copy and download

How to use the URL Encoder and Decoder

  1. 1Choose Encode to make text URL-safe, or Decode to turn %XX sequences back into text.
  2. 2Pick Value when encoding a single query value or path segment, or Whole URL when encoding a complete link.
  3. 3Turn on Spaces as + if the string comes from or goes to an HTML form.
  4. 4Paste your text. The result updates as you type; copy it, download it, or use it as the next input.
  5. 5If the input contains a query string, check the decoded parameters in the table below the tool.

What is URL encoding?

A URL may only contain a limited set of ASCII characters. Anything else — spaces, accented letters, emoji, or characters that already mean something in a URL such as & and ? — has to be percent-encoded: converted to its UTF-8 bytes, with each byte written as % plus two hexadecimal digits.

So café au lait becomes caf%C3%A9%20au%20lait: the space is byte 20, and é is the two UTF-8 bytes C3 A9. The rules come from RFC 3986, the standard that defines URL syntax.

Should I encode the value or the whole URL?

Getting this wrong is a common cause of broken links. The answer depends on what you are encoding:

You are encodingUseJavaScriptLeaves alone
One query value, e.g. a search termValueencodeURIComponentA–Z a–z 0–9 - _ . ! ~ * ' ( )
A path segment, e.g. a file nameValueencodeURIComponentSame as above
A complete URL you want to stay clickableWhole URLencodeURIThe above plus ; , / ? : @ & = + $ #

Encode each value before joining it into the URL. If you encode a value with encodeURI, an & inside it survives and silently splits your parameter in two. If you encode a whole URL with encodeURIComponent, the :// and / get escaped and the link stops working.

Why do some URLs use + instead of %20?

Both mean a space, but in different places. HTML forms submit data as application/x-www-form-urlencoded, which writes spaces as +. Most server frameworks (and URLSearchParams in the browser) decode + as a space in the query string.

In the path part of a URL, though, + is a literal plus sign. When in doubt, use %20: it means a space everywhere. Turn on Spaces as + only when you are matching form submissions.

Which characters need percent-encoding?

CharacterEncodedWhy it needs encoding
Space%20 (or + in forms)Not allowed in URLs
&%26Separates query parameters
=%3DSeparates a key from its value
?%3FStarts the query string
#%23Starts the fragment
/%2FSeparates path segments
+%2BMeans a space in form data
%%25Starts every escape sequence
é%C3%A9Non-ASCII, sent as UTF-8 bytes

How do I URL-encode a string in code?

Every mainstream language has a built-in, so you rarely need a library:

// JavaScript / TypeScript
const url = `https://example.com/search?q=${encodeURIComponent(query)}`;
new URLSearchParams({ q: query }).toString(); // form-style, spaces as +

# Python
from urllib.parse import quote, urlencode
quote("café au lait")            # 'caf%C3%A9%20au%20lait'
urlencode({"q": "café au lait"}) # 'q=caf%C3%A9+au+lait'

// Go
url.QueryEscape("café au lait") // "caf%C3%A9+au+lait"
url.PathEscape("café au lait")  // "caf%C3%A9%20au%20lait"

// C#
Uri.EscapeDataString("café au lait")     // "caf%C3%A9%20au%20lait"
WebUtility.UrlEncode("café au lait")     // "caf%C3%A9+au+lait"

Building query strings with URLSearchParams (or your language's equivalent) is safer than gluing strings together, because it encodes every key and value for you.

Frequently asked questions

encodeURIComponent escapes the characters that structure a URL, including / ? : @ & = + $ # and commas, leaving only letters, digits and - _ . ! ~ * ' ( ), so it is right for a single query value or path segment. encodeURI leaves those structural characters alone, so it is right for a complete URL that must keep working as a link.
Every % must be followed by two hexadecimal digits, and the resulting bytes must be valid UTF-8. A stray % (for example "100% off"), a truncated sequence like %E2%82, or text that was encoded with a legacy character set will all fail. The tool points to the first broken sequence so you can fix it.
%20 is correct everywhere in a URL. A + means a space only inside form-encoded query strings (application/x-www-form-urlencoded). In a URL path, + is a literal plus sign.
No. The unreserved characters A to Z, a to z, 0 to 9, hyphen, underscore, period and tilde never need encoding. RFC 3986 treats %41 and A as equal but says producers should not encode them, because it only makes URLs longer and harder to read.
No. Encoding and decoding run entirely in your browser with JavaScript's built-in functions. Nothing you paste is uploaded, logged or stored.
Yes. Double-encoded text shows sequences like %2520 (an encoded %20). Decode once, then click "Use result as input" and decode again until the text is readable.

Last updated by the Playxoft engineering team.

From the engineers who built this tool

Building something bigger than a quick fix?

Auth, payments, dashboards and security are where web apps get hard. We have shipped them many times. Share your idea and we will map out a realistic plan and estimate, free and with no obligation.

More free tools

See all tools

JWT Decoder

Decode JWTs, explain every claim and expiry, verify signatures and sign new tokens.

Open tool

Base64 Encoder and Decoder

Encode text or files to Base64 and back, with Base64url, data URIs and type-detected downloads.

Open tool

Hash Generator

MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for text or files, with HMAC and checksum verify.

Open tool

UUID Generator

Generate v4 and v7 UUIDs in bulk, and decode any UUID's version and timestamp.

Open tool

Nanoid Generator

Generate nanoid IDs with any alphabet and length, and check how long until a collision.

Open tool

ULID Generator

Generate sortable ULIDs in bulk, decode their timestamps and convert them to UUIDs.

Open tool