URL Encoder and Decoder

What URL encoding does

A URL may only contain a limited set of ASCII characters. Anything outside that set — spaces, accented letters, most punctuation, and characters that have structural meaning such as &, ?, = and / when they appear inside a value — has to be percent-encoded: a % followed by the two hex digits of each UTF-8 byte. A space becomes %20; é is two bytes and becomes %C3%A9; the euro sign is three bytes, %E2%82%AC.

Decoding reverses that: %C3%A9 is read back as the byte pair 0xC3 0xA9 and rendered as é.

How to decode a URL

Paste the encoded link or string and choose Decode URL (Auto-detect switches to decoding by itself when it sees %XX sequences). The URL decoder turns every percent sequence back into its UTF-8 character, and when the result is a full address it also splits it into scheme, host, path and a table of query parameters — handy for reading tracking links, OAuth redirect_uri values, or API calls copied from browser dev tools.

• Plus signs: in application/x-www-form-urlencoded data (HTML form submissions and most query strings) + means a space. Choose Form (+ for space) to decode red+shoes as red shoes; the other modes keep + literally, as a path segment requires.
• Double-encoded values: %2520 is a space encoded twice (% → %25). The tool warns when it sees this and offers Decode fully, which repeats decoding until the text stops changing and tells you how many layers there were.
• “URI malformed” errors: a lone %, a sequence like %G1, or bytes that are not valid UTF-8 (for example Latin-1 %E9 on its own) cannot be decoded. Fix or escape the stray % as %25.
• Decoded text can be unsafe: a decoded value may contain <script>, quotes or ../. Decode for reading, but escape before inserting it into HTML, SQL or a file path.

Which mode to use

Mode	JavaScript equivalent	Use it for
Component value	encodeURIComponent()	A single query-parameter value, a path segment, or a form field. Encodes / ? & = # : and space.
Full URL	encodeURI()	An entire URL that only needs spaces and non-ASCII characters fixed. Leaves / ? & = # : intact so the URL still works.
Form (+ for space)	encodeURIComponent() then %20→+	The body or query of an application/x-www-form-urlencoded request, where a space is conventionally +.

The most common bug is running Full URL on a value that itself contains & or =. Those characters survive, the browser or server splits on them, and the request breaks. When in doubt, encode each value with Component value and build the URL from the encoded pieces.

URL-encode JSON or XML

To pass a whole JSON object or XML document in a GET query string, a deep link, an OAuth state value or a webhook callback URL, encode it as one parameter value with Component value mode (encodeURIComponent). That escapes every brace, quote, colon, comma, angle bracket, slash, & and = inside the payload, so none of them can break the surrounding URL. Paste the JSON or XML above and choose Encode URL; the tool confirms when the input is valid JSON or well-formed XML. To go back, choose Decode URL: a decoded JSON value gets a Pretty-print JSON button, and decoded XML is checked for well-formedness. The round trip is lossless.

Payload	Input	URL-encoded (Component value)
JSON	{"q":"café & tea","page":2}	%7B%22q%22%3A%22caf%C3%A9%20%26%20tea%22%2C%22page%22%3A2%7D
XML	<id>7</id>	%3Cid%3E7%3C%2Fid%3E

Common payload characters: { %7B, } %7D, [ %5B, ] %5D, " %22, : %3A, , %2C, < %3C, > %3E, / %2F. Two notes: URL encoding is not compression or encryption — the result is longer and anyone can decode it — and it does not minify, so minify the JSON first if URL length matters (many servers cap URLs at about 8 KB). Do not use Full URL mode for a payload: it leaves & = ? / # unencoded.

Percent-encoding reference

Character	Encoded	Character	Encoded
space	%20 (or + in forms)	#	%23
!	%21	$	%24
&	%26	'	%27
(	%28	)	%29
+	%2B	,	%2C
/	%2F	:	%3A
;	%3B	=	%3D
?	%3F	@	%40
%	%25	"	%22

Never encoded (the unreserved set): A–Z a–z 0–9 - _ . ~. The encodeURIComponent function also leaves ! * ' ( ) untouched even though they are reserved — encode those yourself if a strict parser needs them escaped.

Encoding in code

JavaScript

const url = "https://api.example.com/search?q="
  + encodeURIComponent("café & croissant");
// .../search?q=caf%C3%A9%20%26%20croissant

decodeURIComponent("caf%C3%A9%20%26%20croissant"); // "café & croissant"

Python

from urllib.parse import quote, quote_plus, unquote

quote("café & croissant")        # 'caf%C3%A9%20%26%20croissant'
quote_plus("café & croissant")   # 'caf%C3%A9+%26+croissant'  (form style)
unquote("caf%C3%A9%20%26%20croissant")  # 'café & croissant'

PHP

rawurlencode("café & croissant"); // caf%C3%A9%20%26%20croissant
urlencode("café & croissant");    // caf%C3%A9+%26+croissant  (form style)
rawurldecode("caf%C3%A9%20%26%20croissant");

Java

import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;

URLEncoder.encode("café & croissant", StandardCharsets.UTF_8);
// caf%C3%A9+%26+croissant  — Java uses form (+) style; replace "+" with "%20" for path use
URLDecoder.decode("caf%C3%A9+%26+croissant", StandardCharsets.UTF_8); // "café & croissant"

Go

url.QueryEscape("café & croissant")   // caf%C3%A9+%26+croissant  (form style)
url.PathEscape("café & croissant")    // caf%C3%A9%20&%20croissant
s, err := url.QueryUnescape("caf%C3%A9+%26+croissant")

Bash / command line

# encode with jq (no Python needed)
printf '%s' 'café & croissant' | jq -sRr @uri      # caf%C3%A9%20%26%20croissant
# decode with Python's standard library
python3 -c 'import sys,urllib.parse as u;print(u.unquote_plus(sys.argv[1]))' 'caf%C3%A9+%26+croissant'

Common questions