URL Encoder and Decoder
- Updated
- Formula shown
- Free, no sign-up
Results
encodeURIComponent: 29 characters encoded to 65
Caf%C3%A9%20%26%20cr%C3%A8me%20br%C3%BBl%C3%A9e%3F%2050%25%20off!
| Method | Result |
|---|---|
| encodeURIComponent | Caf%C3%A9%20%26%20cr%C3%A8me%20br%C3%BBl%C3%A9e%3F%2050%25%20off! |
| encodeURI | Caf%C3%A9%20&%20cr%C3%A8me%20br%C3%BBl%C3%A9e?%2050%25%20off! |
| Form (x-www-form-urlencoded) | Caf%C3%A9+%26+cr%C3%A8me+br%C3%BBl%C3%A9e%3F+50%25+off%21 |
| RFC 3986 strict | Caf%C3%A9%20%26%20cr%C3%A8me%20br%C3%BBl%C3%A9e%3F%2050%25%20off%21 |
Everything runs in your browser. What you type is also kept in this page’s address so the link can be shared (a link restores only the first 2,000 characters), so don’t paste URLs that contain passwords or private tokens.
How to use the URL encoder and decoder
- Choose a task: encode text, decode percent-encoded text, or parse a URL.
- To encode, pick the method that matches where the text will go (see the table below), then copy the result.
- To decode, say whether + means a space. It does in form data and most query strings, but not in paths.
- To parse, paste a full URL. Query parameters are listed one per row, decoded, and repeated names are kept.
Inputs are limited to 20,000 characters. Everything runs in your browser: nothing is sent to our server, and your text is not added to the page address, share links or saved calculations (only your settings are).
Percent-encoding formula
é → C3 A9 → %C3%A9 space → %20 (or + in form data)
URLs may only contain a limited set of ASCII characters, and some of those, such as ? & = / and #, have special meanings. Percent-encoding (RFC 3986) writes any other byte as a percent sign followed by its value in hexadecimal. Text is first converted to UTF-8, so one accented letter becomes two escapes and an emoji becomes four. The methods differ only in which characters they leave alone.
Which method to use
- encodeURIComponent for one piece of a URL: a query value, a path segment or a fragment. It escapes ? & = / # so they can't break the URL's structure.
- encodeURI for a complete URL that only needs spaces and non-ASCII characters fixed. It leaves the URL's punctuation in place, so never use it on a single value.
- Form data (application/x-www-form-urlencoded) is what HTML forms and
URLSearchParamsproduce: spaces become + and only letters, digits and * - . _ stay as they are. - RFC 3986 strict also escapes ! ' ( ) and *, which some APIs and OAuth 1.0 signatures require.
Worked example
To search for "rock & roll", the value must be encoded before it goes into the query string. encodeURIComponent gives rock%20%26%20roll and form encoding
gives rock+%26+roll. encodeURI would give rock%20&%20roll, leaving the & unescaped, so a server would read "rock " as the value and " roll"
as a second, empty parameter. Parsing https://shop.example.com/search?q=rock+%26+roll&page=2#results gives the host shop.example.com, default
port 443, path /search, 2 parameters (q = "rock & roll" and page = 2) and the fragment
#results, which the browser keeps to itself rather than sending to the server.
Decoding catches broken input too. caf%E9 is "café" in the old Latin-1 character set, not UTF-8, so the decoder stops with: The bytes starting with %E9 at position 4 are not valid UTF-8 (%E9…). The text may have been encoded in another character set, such as Latin-1, or cut off in the middle of a character.
How each method encodes special characters
| Character | encodeURIComponent | encodeURI | Form data | RFC 3986 |
|---|---|---|---|---|
| space | %20 | %20 | + | %20 |
| ! | ! | ! | %21 | %21 |
| # | %23 | # | %23 | %23 |
| $ | %24 | $ | %24 | %24 |
| % | %25 | %25 | %25 | %25 |
| & | %26 | & | %26 | %26 |
| ' | ' | ' | %27 | %27 |
| ( | ( | ( | %28 | %28 |
| ) | ) | ) | %29 | %29 |
| * | * | * | * | %2A |
| + | %2B | + | %2B | %2B |
| , | %2C | , | %2C | %2C |
| / | %2F | / | %2F | %2F |
| : | %3A | : | %3A | %3A |
| ; | %3B | ; | %3B | %3B |
| = | %3D | = | %3D | %3D |
| ? | %3F | ? | %3F | %3F |
| @ | %40 | @ | %40 | %40 |
| ~ | ~ | ~ | %7E | ~ |
| é | %C3%A9 | %C3%A9 | %C3%A9 | %C3%A9 |
| € | %E2%82%AC | %E2%82%AC | %E2%82%AC | %E2%82%AC |
| 😀 | %F0%9F%98%80 | %F0%9F%98%80 | %F0%9F%98%80 | %F0%9F%98%80 |
Common mistakes
- Double encoding. Encoding text that is already encoded turns %20 into %2520. Decode first if you aren't sure.
- A bare % sign. "100%" in a URL must be written 100%25; otherwise the decoder sees a broken escape.
- + in paths. A + only means a space in query strings and form data. In a path, a space must be %20.
- Secrets in URLs. URLs end up in browser history, server logs and analytics. Send passwords and tokens in headers or the request body instead.
To encode binary data as text, use the Base64 encoder and decoder. Network questions? Try the IP subnet calculator or the bandwidth calculator.
Sources
- RFC 3986, Uniform Resource Identifier (URI): Generic Syntax, sections 2.1 to 2.4 (percent-encoding and reserved characters).
- WHATWG URL Standard, application/x-www-form-urlencoded serializer and URL parsing.
- ECMAScript specification, encodeURI and encodeURIComponent.
Frequently asked questions
What is URL encoding?
Also called percent-encoding, it writes characters that are not allowed or have a special meaning in a URL as % followed by two hex digits. Text is converted to UTF-8 first, so a space becomes %20, & becomes %26 and é becomes %C3%A9.
What is the difference between encodeURI and encodeURIComponent?
encodeURI is for a whole URL and leaves its punctuation, such as / ? & = and #, unchanged. encodeURIComponent is for one part, such as a query value, and escapes those characters too. "rock & roll" becomes rock%20%26%20roll with encodeURIComponent but rock%20&%20roll with encodeURI, which breaks a query string.
Should a space be %20 or +?
Both mean a space in a query string or form data (application/x-www-form-urlencoded), which is what HTML forms send. In the path part of a URL only %20 works, because + there is a literal plus sign. When unsure, %20 is the safe choice.
Why do I get a "malformed" error when decoding?
Either a % is not followed by two hex digits, such as a bare "100%", which should be written 100%25, or the escapes do not form valid UTF-8. For example, caf%E9 is "café" in the older Latin-1 character set; in UTF-8 it is caf%C3%A9.
Is the URL fragment sent to the server?
No. The fragment, the part after #, stays in the browser and is used to jump to a section or by scripts on the page. Everything before it, including the query string, is sent with the request. The parser shows each part separately.