URL Encoder and Decoder Online Free — Encode Special Characters Instantly

What Is URL Encoding and Why Does It Exist?

A URL has strict structural rules. Certain characters — ?, &, =, #, / — are reserved: they delimit parts of the URL. If one of these characters appears inside a value rather than as a delimiter, the parser cannot tell the difference. The only way to include a literal & in a query string value is to encode it as %26, so the parser knows it is data, not a separator.

A second category is unsafe characters: those that browsers, proxies, and servers may silently modify or strip. Spaces are the obvious example — a bare space in a URL is invalid and gets interpreted inconsistently across systems. The percent-encoded form %20 travels safely through every HTTP intermediary without ambiguity.

Non-ASCII characters add a third layer. Unicode characters like é, π, or emoji have no direct place in a URL. The convention — required by RFC 3986 and IRI processing rules — is to encode them as UTF-8 bytes first, then percent-encode each byte. The euro sign € becomes three UTF-8 bytes E2 82 AC and therefore %E2%82%AC in a URL.

How to Encode or Decode a URL with the Tool

Common Encoded Characters Quick Reference

Character	Percent encoding	Where it appears / why it matters
Space	%20	The most common encoding need; bare spaces are invalid in URLs
& (ampersand)	%26	Separates query string parameters; must be encoded inside a value
= (equals)	%3D	Separates key from value in query strings; encode when it appears in a value
? (question mark)	%3F	Begins the query string; encode when a ? appears inside a parameter value
# (hash / pound)	%23	Starts the fragment identifier; browsers strip everything after it before sending to the server
+ (plus)	%2B	Means a space in form-encoded data; encode as %2B to preserve a literal plus sign
/ (slash)	%2F	Path segment separator; encode only when a slash appears inside a segment value
: (colon)	%3A	Separates scheme from authority (e.g. https:); encode inside path segments
@ (at sign)	%40	Used in authority for userinfo; encode when it appears as data in a path or query
% (percent)	%25	The encoding prefix itself; a literal percent sign must be encoded as %25

encodeURI vs encodeURIComponent — When to Use Each

// encodeURI — preserves URL structure, encodes only truly unsafe chars
const url = "https://example.com/search?q=hello world&lang=en";
console.log(encodeURI(url));
// → "https://example.com/search?q=hello%20world&lang=en"
// Notice: & and = are left alone because they are structural

// encodeURIComponent — encodes everything including reserved chars
const value = "hello world & goodbye";
console.log(encodeURIComponent(value));
// → "hello%20world%20%26%20goodbye"
// Notice: & is now %26, safe to embed as a parameter value

// Building a URL with parameters — the correct pattern
const base = "https://api.example.com/search";
const query = encodeURIComponent("C# async/await");
const lang  = encodeURIComponent("en-US");
const final = `${base}?q=${query}&lang=${lang}`;
// → "https://api.example.com/search?q=C%23%20async%2Fawait&lang=en-US"

URL Decoding: Reading Percent-Encoded Strings from Logs

Log analysis is the most common reason developers reach for a URL decoder. Web server logs, CDN logs, and API gateway logs all record raw encoded URLs. Search queries, file paths, and user-submitted values show up as strings of percent signs and hex digits. Pasting a line into a decoder takes one second and immediately reveals what the user actually searched for or what path they hit.

Redirect chains compound this. A redirect from page A to page B to page C often carries the original destination URL as a parameter in the redirect URL. After two or three hops, the destination is a doubly or triply encoded string. Decoding it step by step — decode once, inspect, decode again if needed — is the fastest way to trace where a redirect is pointing.

Query strings in analytics platforms are another source. UTM parameters, attribution tokens, and campaign IDs often contain encoded characters when copied from a tracking URL builder or exported from an analytics dashboard. Decoding reveals the readable campaign names and source values.

Common Mistakes: Double-Encoding and Encoding Slashes

Double-encoding

This happens when you encode something that is already encoded. If you receive a URL like /file?name=hello%20world and then run the whole string through encodeURIComponent, the % in %20 becomes %25, producing hello%2520world. The server decodes it once and gets hello%20world as the literal string, not hello world.

The fix is to always encode raw unencoded values, never re-encode an already-encoded string. If you are unsure whether input is encoded, decode it first to guarantee you have the raw value, then encode it exactly once before inserting it into a URL.

Encoding path slashes when you should not

If your path is /api/v1/users/123 and you run it through encodeURIComponent, the slashes become %2F and the server receives a single path segment %2Fapi%2Fv1%2Fusers%2F123 rather than a four-level path. Most servers will either 404 or route it incorrectly. Use encodeURI for complete paths (which leaves / alone) or encode each segment individually with encodeURIComponent and then join them with literal / characters.

Plus sign confusion

Some URL builders encode spaces as + instead of %20. The plus-as-space convention comes from the application/x-www-form-urlencoded format used in HTML form submissions — it is not part of RFC 3986. A + in a path segment is a literal plus sign, not a space. Mixing contexts leads to searches that literally include a + character when the user typed a space. The safe choice is always %20.

Use Cases: API Query Strings, Redirect Debugging, Form Data

Building API query strings

REST API calls frequently include search terms, filter values, or identifiers as query parameters. A search for C# async/await tutorial becomes ?q=C%23%20async%2Fawait%20tutorial once properly encoded. Forgetting to encode the # is especially damaging: browsers treat it as the start of a URL fragment and discard everything after it before making the HTTP request. The server never sees the query.

Debugging redirect loops

Redirect chains often carry a returnTo or next parameter that holds the URL the user should land on after authentication or a middleware step. That inner URL is percent-encoded. When a redirect loop occurs, pasting the full URL into a decoder and reading the embedded destination is the fastest way to diagnose whether the redirect is pointing somewhere that immediately redirects back.

Form data encoding

HTML forms submitted with method="GET" append field values to the URL as a query string. The browser encodes them automatically, but when you build form-style strings programmatically — for an OAuth request body, a webhook payload, or a URL-encoded POST — you need to encode each value with encodeURIComponent (or Python's urllib.parse.urlencode) and join pairs with &. Skipping encoding for "simple" values is the source of subtle bugs that surface only when users have names or addresses containing ampersands or equals signs.