URL Encoder / Decoder

URL encoding converts reserved characters, non-ASCII symbols, and spaces into percent-encoded UTF-8 octets so web addresses can travel across browsers, proxies, and servers without corrupting paths or query strings. This free tool encodes and decodes URLs, query parameters, and raw text with RFC 3986 precision. It grades encoding compliance, detects double-encoding, extracts query parameters into an inspection table, and identifies malformed byte sequences. Everything runs locally in your browser with complete privacy.

What is URL encoding and decoding?

URL encoding (technically termed percent-encoding) is the standardized mechanism specified by RFC 3986 for encoding arbitrary binary data and special characters within a Uniform Resource Identifier (URI). Because URIs use a restricted subset of US-ASCII characters to denote structural boundaries—such as the scheme separator :, authority slashes //, path separators /, query string indicators ?, parameter delimiters &, and value assignments =—any literal data containing those characters must be escaped so parsers do not mistake data for syntax.

When you encode a character, it is converted into its underlying UTF-8 byte sequence, with each byte represented by a percent sign followed by two hexadecimal digits (%XX). Decoding reverses this process, reading percent-encoded hexadecimal byte octets and converting them back into readable UTF-8 text strings.

How to use this URL encoder / decoder

1. Paste your string or URL: Enter any web address, query string, JSON payload, or raw text into the input field.
2. Select your operation mode: Choose Encode to escape raw text into safe URL format, or Decode to convert percent-encoded strings back to human-readable characters.
3. Choose your encoding scope:
   • Component (RFC 3986 Value): The standard for individual query parameter values. Escapes delimiters such as /, ?, &, =, and :.
   • Full URL (encodeURI): Preserves structural URL punctuation (https://, slashes, query delimiters) while escaping spaces and non-ASCII characters.
   • Strict RFC 3986: Enforces strict escaping of sub-delimiters (!, ', (, ), *) required by modern REST APIs and OAuth 1.0a/2.0 signatures.
4. Select space encoding format: Choose between standard percent-encoding (%20) and form-urlencoded submission (+).
5. Review the RFC compliance score: Inspect the live 0–100 score gauge, letter grade, and diagnostic notes to identify malformed sequences or accidental double-encoding.
6. Inspect parameters and copy: Review the extracted query parameter table or character breakdown below, then click Copy output.

How URL percent-encoding works (RFC 3986 vs application/x-www-form-urlencoded)

Web developers frequently encounter two distinct flavors of URL encoding that behave slightly differently. Understanding their distinctions prevents subtle bugs in analytics tracking, API calls, and authentication flows.

Dimension	RFC 3986 Percent-Encoding	application/x-www-form-urlencoded
Governing Standard	IETF RFC 3986 (Uniform Resource Identifier)	W3C HTML Form Specification / WHATWG URL
Space Encoding	%20	+ (plus sign) or %20
Primary Use Case	REST APIs, URL paths, OAuth signatures, query values	HTML form submissions (POST/GET), legacy query strings
Literal Plus Sign (+)	Unreserved (remains literal +)	Reserved (must be encoded as %2B to avoid becoming a space)
Unreserved Characters	A-Z, a-z, 0-9, -, _, ., ~	A-Z, a-z, 0-9, *, -, ., _

The single most common bug occurs when an unencoded literal plus sign (+) is sent inside a query parameter expecting form-urlencoded data. The receiving backend interprets the + as a space, mutating email addresses (e.g., [email protected] becomes alex [email protected]). In strict RFC 3986 percent-encoding, spaces are always safely written as %20.

encodeURI vs encodeURIComponent vs Strict RFC 3986

Standard JavaScript runtimes provide two native encoding functions, but neither implements full RFC 3986 compliance out of the box. Here is how they compare:

Method / Scope	Preserves Delimiters (://, /, ?, &, =)	Encodes Characters (!, ', (, ), *)	Best Used For
encodeURI	Yes (leaves delimiters unescaped)	No	Encoding a complete, pre-constructed web address with invalid characters in the path.
encodeURIComponent	No (escapes all delimiters)	No (leaves !'()* untouched)	Encoding individual parameter values inside query strings.
Strict RFC 3986	No (escapes all delimiters)	Yes (escapes !'()* as %21, %27, %28, %29, %2A)	OAuth signing, AWS Signature Version 4, strict REST APIs, and webhook payloads.

Common URL encoding pitfalls and how to avoid them

1. Double encoding (The %2520 bug)

Double encoding happens when an already-encoded string is passed into an encoder a second time. The percent symbol (%) is itself a reserved character whose hex byte is %25. If you encode Hello World once, it becomes Hello%20World. If you inadvertently encode that output again, the encoder sees the % in %20 and transforms it into %2520. When decoded on the receiving server with a single decoding pass, the resulting string contains literal %20 characters instead of spaces.

2. Breaking query strings with unencoded ampersands and equals signs

If a parameter value contains an ampersand (such as a company name like Founders & Co), sending ?company=Founders & Co breaks the URL parser. The web server reads two distinct parameters: company=Founders and a key named Co with no value. The ampersand must be percent-encoded as %26, yielding ?company=Founders%20%26%20Co.

3. Multi-byte UTF-8 encoding for international characters and emojis

Modern URLs support all Unicode code points via UTF-8 octet serialization. Standard ASCII characters (0–127) encode into a single percent-byte (e.g., space is %20). However, non-Latin characters and symbols expand across multiple bytes:

• 2-byte characters (Latin extended, Greek, Cyrillic, Arabic): é (U+00E9) encodes as %C3%A9.
• 3-byte characters (CJK characters, Devanagari): 你 (U+4F60) encodes as %E4%BD%A0.
• 4-byte characters (Emojis, mathematical symbols): 🚀 (U+1F680) encodes as %F0%9F%9A%80.

4. Truncated and malformed percent sequences

A percent sign must always be followed by exactly two valid hexadecimal characters (0-9, a-f, A-F). If a string ends with a dangling percent sign (test%) or invalid characters (%G5), native decoders throw a fatal URIError: URI malformed. This tool detects and pinpoints malformed bytes so you can fix them before sending them into production code.

URL percent-encoding character reference table

Character	ASCII / Unicode	Percent-Encoded	RFC 3986 Status	Description
[Space]	U+0020	%20 or +	Reserved	Space delimiter
!	U+0021	%21	Sub-delim	Exclamation mark
"	U+0022	%22	Reserved	Double quote
#	U+0023	%23	Gen-delim	Fragment identifier / hash
$	U+0024	%24	Sub-delim	Dollar sign
%	U+0025	%25	Reserved	Percent indicator symbol
&	U+0026	%26	Sub-delim	Query parameter separator
'	U+0027	%27	Sub-delim	Single quote
(	U+0028	%28	Sub-delim	Opening parenthesis
)	U+0029	%29	Sub-delim	Closing parenthesis
*	U+002A	%2A	Sub-delim	Asterisk
+	U+002B	%2B	Sub-delim	Plus sign
,	U+002C	%2C	Sub-delim	Comma
/	U+002F	%2F	Gen-delim	Path segment separator
:	U+003A	%3A	Gen-delim	Scheme / port delimiter
;	U+003B	%3B	Sub-delim	Semicolon
=	U+003D	%3D	Sub-delim	Parameter assignment operator
?	U+003F	%3F	Gen-delim	Query string prefix
@	U+0040	%40	Gen-delim	Userinfo delimiter
[	U+005B	%5B	Gen-delim	IPv6 host bracket open
]	U+005D	%5D	Gen-delim	IPv6 host bracket close

Worked examples

Input String	Mode & Scope	Converted Output	Technical Takeaway
https://mizanursguide.com/search?q=cold email	Encode (Full URL)	https://mizanursguide.com/search?q=cold%20email	Preserves https://, ?, and = while encoding the space.
Founders & Investors (Q3)	Encode (Component)	Founders%20%26%20Investors%20(Q3)	Safely encodes the ampersand so it does not split a query parameter.
Founders & Investors (Q3)	Encode (Strict RFC 3986)	Founders%20%26%20Investors%20%28Q3%29	Encodes parentheses into %28 and %29 for strict API compliance.
tag=marketing%26sales&status=active	Decode (Component)	tag=marketing&sales&status=active	Decodes percent-encoded entities back into literal text strings.

Limitations and accuracy

• Client-Side Execution: All conversions execute entirely within your browser's JavaScript engine. No URLs, query strings, or payloads are transmitted to any external server.
• Maximum String Length: The tool processes inputs up to several hundred thousand characters smoothly; extremely large multi-megabyte payloads may be constrained by local device memory.
• Character Set Assumptions: All percent-encoding conversions follow UTF-8 octet serialization. Legacy single-byte encodings (such as ISO-8859-1 or Windows-1252) are not converted.
• Fault-Tolerant Fallback: If an input contains broken or truncated multi-byte sequences, the tool inserts standard replacement glyphs (\uFFFD) rather than crashing, while flagging the exact malformed indices.

Frequently asked questions

Why does my URL parameter with a plus sign turn into a space?

In HTML form encoding (application/x-www-form-urlencoded), the plus sign (+) represents a space. When a web server decodes incoming query parameters using form decoding rules, any literal + is converted to a space. To pass a literal plus sign safely, encode it as %2B.

Should I use %20 or + for spaces in query strings?

For standard REST APIs, OAuth parameters, and general URLs, use %20. It is universally compliant with RFC 3986. Use + only when specifically working with HTML form GET/POST requests or legacy systems that require application/x-www-form-urlencoded format.

What causes a "URI malformed" error in JavaScript?

JavaScript's native decodeURIComponent() throws a URIError whenever it encounters a percent sign not followed by two valid hexadecimal characters (e.g. %Z9 or a trailing %), or when multi-byte UTF-8 continuation bytes are missing. This tool prevents crashes by utilizing a fault-tolerant tokenizer that highlights malformed sequences.

Does this tool store or log my URLs?

No. Everything runs strictly inside your local browser tab. No network requests are dispatched, no analytics track your input, and no cookies or local storage entries are created.

Can I encode whole query strings at once?

Yes. If you have an entire URL with query parameters, use Full URL mode to preserve the path and query punctuation while escaping invalid characters. If you are preparing a single parameter value that might contain &, =, or /, use Component mode.

Related tools

• Slug Generator & Optimizer — Clean, format, and optimize URL slugs for search engine visibility.
• UTM Bulk Builder — Build and validate bulk UTM tracking campaign links for Google Analytics.
• Base64 Encoder/Decoder — Encode and decode binary strings and API tokens directly in your browser.

Next step

Building SaaS marketing funnels, API integrations, or cold outreach systems that rely on tracking URLs and campaign parameters? Explore our SaaS launch marketing services to see how we build high-converting growth systems.