URL Encoder & Decoder

Percent-encode and decode URLs in your browser, with every parameter read back to you. Nothing is uploaded.

100% Browser-Based • Local Processing
Scope
Spaces
URL or text
Encoded no query
The result appears here as you type.

Waiting for input In 0 chars Out — Change — Read as —

🧩 RELATED TOOLS
JSON Validator Text to Binary Timestamp Converter Color Converter HMAC Generator SQL Formatter All Developer Tools

Privacy Focused

🔒 Local Processing. Your code never leaves your device.

Instant Results

🌐 Fully Client-Side. Runs instantly in your browser.

No Signup

⚡ No accounts. No API keys. Just open and use.

Browser Based

🚀 No installs, no CLI, no build step.

Overview

Understanding URL & Percent Encoding

Percent-encode a URL or decode one back, in your browser. Component scope encodes every character RFC 3986 reserves; Full URL scope keeps ://, / and ? intact. A malformed escape is named and located rather than throwing the whole string away, and the query inspector splits an address into its parts and decodes each parameter once. Nothing is uploaded.

Percent-encoding is how a URL carries a character it is not allowed to spell. The character's UTF-8 bytes are written as % followed by two hex digits, so a space becomes %20 and é becomes %C3%A9. Which characters need it depends entirely on where in the URL they sit, which is the one thing most encoders hide from you and the reason this one asks for a scope before it converts anything.

Two things here work differently from the browser functions underneath. Component scope keeps only the unreserved set — letters, digits, - . _ ~ — so ! ' ( ) * come out encoded, where encodeURIComponent leaves them alone. And decoding reads the escapes as bytes against a UTF-8 validator instead of handing the string to decodeURIComponent, which answers every failure with the same three words. A truncated character, a stray continuation byte, an overlong form and a surrogate half each get their own sentence and their own position in the input.

The query inspector reads what you pasted, decoding each parameter exactly once. Once is the whole trick: decode the query first and then parse it and a %26 inside a value turns into a real & that splits one parameter into two, and a second pass over %2520 quietly hands you a space the server never saw. Long payloads are common here — a stringified JSON parameter is worth pasting into our JSON Formatter, and a base64 blob into the Base64 Encoder Decoder. Everything runs in the page. Access tokens, private UUIDs like the ones from our UUID Generator, and customer identifiers stay on your machine, because there is no request for them to travel in.

Guide

How to encode or decode a URL

Paste your URL or text

Anything goes in the left pane: a whole address, one query value, a webhook payload, a line of prose with an ampersand in it. The conversion runs as you type. Nothing is sent anywhere, so an internal link with a session token in it is safe to paste.

Colour in the input tells you what is about to happen. Encoding, the characters that will change are tinted. Decoding, each %XX escape is tinted and any % that is not a real escape is underlined in red.

Set the scope: Component or Full URL

Component keeps only the RFC 3986 unreserved characters — letters, digits, and - . _ ~. Everything else becomes a %XX pair, ! ' ( ) * included. That is the scope for a single query value or one path segment, and it is stricter than JavaScript's own encodeURIComponent, which leaves those five alone.

Full URL keeps the characters that hold an address together: ://, /, ?, &, =, #. Use it on a complete link. Decoding follows the same rule in reverse, so a %2F inside a path stays encoded rather than turning into a slash that changes what the URL points at.

The tool in Full URL scope encoding https://randomly.online/search?q=café and croissant. The result keeps the scheme, the slashes and the question mark and encodes only the space and the accented character, and the status line reads Encoded.
Full URL scope encodes the space and the accented letter and leaves the structure alone. Component scope would have turned the :// into %3A%2F%2F.
Pick the direction, or leave it on Auto

Auto reads the input and tells you what it decided, in the Read as reading on the status line: encoded — it contains %20, or plain text — no percent escapes in it. It is a guess, and it says so.

Text with a percent sign in it that is not an escape — 80% off, %zz — is read as plain text and encoded. When the guess is wrong, press Encode or Decode and the direction stops moving.

Read the query inspector

Whenever what you paste is an address, the output pane breaks it up underneath the result: scheme, host, path, fragment, then a row for each query parameter with its value decoded once. The pane header counts them.

Four things get flagged rather than left for you to spot. A value that still holds %XX after one decode is marked encoded twice. A + is marked + is a space here, because a query string is form-encoded by convention and the rest of the URL is not. A key that appears more than once is marked repeated key, which is how a duplicated parameter gets found. A broken escape is marked bad escape. If the token you are chasing is a JWT, our JWT Decoder reads its claims.

The output pane of the tool, scrolled down to its query table. Above it sit rows for Host, Path and Fragment; below it, five query parameters. The q row is tagged plus is a space here, the next row is tagged encoded twice, and the second utm_source row is tagged repeated key.
Every parameter decoded once, with the readings that are usually left to the reader: a plus that means a space, a value encoded twice, and a key that appears in the query more than once.
Handle a bad escape

A malformed escape has a position and a reason. %E0%A4 is a truncated character, not simply a malformed URI: the lead byte starts a three-byte sequence and only one byte follows. The problem list under the panes says exactly that, with the line and the character it starts at, and clicking the entry selects it in the input.

The Bad escapes switch decides what happens next. Keep going decodes everything it can and copies what it cannot read through exactly as written, so you get the rest of the string back. Stop refuses and returns nothing, which is what strict decodeURIComponent does.

The tool decoding an order URL containing %E0%A4. The problem panel underneath reads Line 1, char 38 and explains that %E0%A4 is a truncated character whose lead byte starts a 3-byte sequence with only one byte following. The output pane still shows the rest of the URL and tags the ref parameter as a bad escape.
A truncated UTF-8 sequence, named and located. Keep going returns the rest of the string with the unreadable escape left exactly as it was written.
Copy the result, or send it back through

Copy puts the result on the clipboard. Use as input moves it into the left pane, which is the answer to a string that was encoded twice: decode %2520 once to get %20, press Use as input, decode again to get the space. The tool says when this applies — a result that still contains escapes carries a note under it.

On a phone the two panes become tabs and both buttons stay in the pane header.

The tool on a phone with the Decoded tab open. The pane holds the decoded URL, a note saying something in it was encoded twice, and the start of the table breaking the address into scheme and host. Use as input and Copy sit in the pane header, and the direction buttons stay on the bar above.
On a phone the input and the result become tabs. The inspector stays with the result.
Support

Frequently Asked Questions

How do I URL-encode or decode a string?

Paste your text or URL, set the scope to Component or Full URL, and the tool percent-encodes it — or decodes an encoded string back — as you type. Auto guesses the direction and tells you what it guessed; Encode and Decode fix it. The query inspector splits the address into its parts and decodes each parameter once. Then copy the result. Everything happens in your browser; nothing is uploaded.

Does this upload anything, and does it work offline?

No upload, and yes it works offline. All encoding and decoding happen in your browser using JavaScript — there's no server involved, no logging, and no tracking. Once the page has loaded it keeps working with no internet connection, which you can confirm in your browser's network tab. Your URLs and parameters never leave your device.

What is URL (percent) encoding?

URL encoding replaces characters that aren't allowed or have special meaning in a URL with a % followed by the character's byte value in hexadecimal. A space becomes %20, & becomes %26, and so on. This lets a URL safely carry spaces, symbols, and non-Latin characters without breaking its structure. Decoding reverses the process, turning each %XX back into the original character.

What's the difference between Full URL and Component mode?

Full URL Mode encodes a whole address while preserving its structure — it leaves ://, /, ?, &, =, and # intact (like JavaScript's encodeURI). Component Mode encodes those reserved characters too, which is what you need for a single query value or path segment. It is stricter than JavaScript's own encodeURIComponent: that function leaves ! ' ( ) * unencoded, and RFC 3986 reserves all five, so this tool encodes them. Use Full URL for a complete link; use Component when escaping one piece that will sit inside a URL.

Is URL encoding encryption or secure?

No. Percent-encoding is an encoding, not encryption — it's fully reversible and hides nothing. Anyone can decode an encoded URL instantly and read exactly what it contains, including any values in the query string. It exists to make URLs valid and unambiguous, not to protect data. Never put a secret in a URL and assume encoding protects it; if you need protection, use encryption and keep secrets out of URLs.

Which characters get percent-encoded?

Characters outside the "unreserved" set — letters, digits, and a few symbols (- _ . ~) — are candidates for encoding. Reserved characters with special URL meaning (: / ? # [ ] @ ! $ & ' ( ) * + , ; =) are encoded in Component mode but preserved in Full URL mode, and unsafe characters like spaces are always encoded. Non-ASCII characters are encoded as their UTF-8 bytes, each byte becoming a %XX pair.

What does Auto-Detect do?

Auto-Detect inspects your input and guesses whether you want to encode or decode, so you don't have to set the direction for the common cases. If the input already contains %XX sequences it leans toward decoding; otherwise it encodes. The reading is on the status line, so you can see the guess before you trust it. When it is wrong — text that happens to contain a percent sign, say — press Encode or Decode and the direction stops moving.

What happens when an escape is malformed?

It gets named and located rather than collapsing the whole string into one error. A truncated character, a lone % with no hex digits after it, a stray continuation byte and an overlong form each produce their own sentence with the line and character it starts at, and clicking that entry selects it in the input. The Bad escapes switch decides what happens to the rest: Keep going decodes everything it can and copies what it cannot read through exactly as written, while Stop refuses and returns nothing, which is what strict decodeURIComponent does.

Why is my string double-encoded (%2520)?

Because it was encoded twice. When you encode a string, a space becomes %20; if you then encode that result again, the % itself gets encoded to %25, turning %20 into %2520. The fix is to decode once for each time it was encoded. The tool says when this applies: a decoded result that still contains escapes carries a note under it, and Use as input puts that result back in the left pane so the second decode is one click. Then find the place in your own code that encodes the value twice.

What does the query inspector show?

It splits the address into scheme, host, path and fragment, then gives each query parameter a row with its value decoded exactly once, rather than leaving you to squint at one long ?a=1&b=2&c=3 string. Four readings are marked rather than left for you to notice: a value that still holds %XX after one decode is encoded twice, a + is a space because a query string is form-encoded by convention, a key that appears more than once is a repeated key, and a broken escape is a bad escape.

Does it encode spaces as %20 or +?

It depends on context, and both are valid in the right place. In a URL path or a standard percent-encoded string, a space is %20. In an application/x-www-form-urlencoded query string — the format HTML forms submit — a space is often +, and a literal + is encoded as %2B. The Spaces switch on the bar picks which one you get: %20 leaves a literal + alone, and + (form) writes a space as + and a real + as %2B. Decoding reads it back the same way round.

Is it free, and are there limits?

Yes, completely free — no payment, no signup, no account, and no usage caps or watermarks. Since everything runs in your browser, there's nothing for us to meter; the only practical limit is your device's performance on very long input. Use it as much as you like, including offline once the page has loaded.

Still have questions?

If you can't find the answer you're looking for, feel free to contact our support team.

Contact Us