URL Encode & Decode

What URL Encode & Decode does

It turns text into the percent-encoded form a URL can carry, and turns that form back into text. Type in one box and the answer appears in the other as you go; swap them round to check that a round trip gives you back what you started with.

There is no such thing as one URL encoding, so this asks which one you want: a value going inside a URL, a whole address that is already assembled, or a form field. They disagree about characters people actually type, and picking one silently is how an ampersand ends up splitting a query string in half.

When a character means something it should not

When a link works for you and not for anyone else. When a search term with a space or a slash in it breaks the URL it was put into. When something arrived as %E2%80%99 and you need to know what it says. When an API wants a value escaped and you would rather see the result than trust it.

It is also the quickest way to find out which of the three encodings a system is using: encode the same string three ways and compare it with what that system produced.

The three encodings, and what they disagree about

All three escape a character by writing a per-cent sign and the hexadecimal of its bytes in UTF-8. What separates them is the list of characters they consider safe to leave alone.

One piece of a URL

For a value going inside a URL: a query parameter, a path segment, a fragment. Everything with a structural job — & = / ? # : and the rest — is escaped, so an ampersand in your text stays part of your text rather than starting the next parameter. This is what you want most of the time.

A whole URL

For an address that is already assembled. The characters that hold a URL together are left alone, because here they are doing their job, and only what would break the address — a space, an angle bracket, a curly brace — is escaped. Use it on a complete link, never on a value going into one.

A form field

What a browser sends when a form is submitted, and what a query string usually holds in practice. A space becomes a plus rather than %20, and a few more characters are escaped than strictly need to be. Decoding this way is the only case where a plus is read back as a space.

Why the plus matters

A plus means a space in a form field and means a plus everywhere else. A tool that turned every plus into a space would quietly corrupt every base64 string it was given, so this one only does it where a plus really is a space.

When decoding goes wrong

The browser’s own decoder throws the same error for every kind of broken input and never says where. This one walks the text and tells you the character position and what is wrong: an escape cut off by the end of the text, a per-cent sign followed by something that is not hexadecimal, or bytes that are perfectly legal escapes and still not a character in UTF-8.

The text does not go anywhere

The conversion is a function running in this browser, on the text in the box. Nothing is sent anywhere, because there is nowhere to send it: this page has no endpoint behind it, no request is made when you type, and what you paste is never uploaded.

That is worth saying for this one. The things people percent-encode are query strings, tokens, callback URLs and identifiers — the contents of a URL that was already sensitive enough to be worth checking twice.