URL Encoder & Decoder

About URL Encoder & Decoder

How to use the URL Encoder & Decoder

1. Paste the text or URL, and choose whether you are encoding a whole URL or a single component value.
2. For a query parameter or path segment value, always use component encoding - it is the safe default.
3. Decode to check what a percent-encoded string actually contains; look for %25 as evidence of double encoding.
4. Copy the result, and confirm that + is handled the way the receiving side expects.

Examples

• Text to encode

  https://uuidstudio.com/search?q=hello world&tag=dev

  Copy example
• Percent-encoded to decode

  hello%20world%2Fapi%3Fid%3D1%262

  Copy example

URL Encoder & Decoder in code

The same operation this tool performs, in the languages you are most likely to need it.

// Component value - escapes / ? & = # + : etc. Use this for values.
encodeURIComponent("a&b=c d/e");   // "a%26b%3Dc%20d%2Fe"

// Whole URL - leaves structure intact. Only for complete URLs.
encodeURI("https://x.com/a b?q=1&r=2");  // "https://x.com/a%20b?q=1&r=2"

// Best: let the URL API do it, and stop hand-building query strings
const url = new URL("https://api.example.com/search");
url.searchParams.set("q", "a&b=c d");
url.searchParams.set("filter", "size>10");
console.log(url.toString());
// Correctly escaped, no concatenation, no double-encoding risk.

// Note: URLSearchParams encodes a space as "+", not "%20".
// Both decode to a space in a query string, but not in a path.

from urllib.parse import quote, quote_plus, urlencode, unquote

quote("a&b=c d")            # 'a%26b%3Dc%20d'  - safe='/' by default!
quote("a/b", safe="")       # 'a%2Fb'          - pass safe="" for values
quote_plus("a b")           # 'a+b'            - form encoding

# Build a query string properly rather than by hand
urlencode({"q": "a&b=c d", "page": 2})   # 'q=a%26b%3Dc+d&page=2'

# Decoding
unquote("%2520")            # '%20'  <- evidence of double encoding

import java.net.URLEncoder;
import java.net.URI;
import java.nio.charset.StandardCharsets;

// URLEncoder is FORM encoding: it turns spaces into "+", which is
// wrong inside a path segment.
String form = URLEncoder.encode("a b&c", StandardCharsets.UTF_8);  // "a+b%26c"

// For a path segment, fix the plus:
String path = form.replace("+", "%20");

// Better: build the URI and let it handle escaping
URI uri = new URI("https", "api.example.com", "/search", "q=a&b", null);

# curl encodes a query parameter for you
curl -G "https://api.example.com/search" --data-urlencode "q=a&b=c d"

# Encode a string
python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "a&b=c d"

# Decode
python3 -c "import urllib.parse,sys; print(urllib.parse.unquote(sys.argv[1]))" "a%26b%3Dc%20d"

When you need this

• Working out why a query parameter arrives truncated at an ampersand or a hash.
• Encoding a search term, filename or email address for safe inclusion in a URL.
• Decoding a redirect_uri or state parameter from an OAuth flow to see what it holds.
• Diagnosing %2520 in a log line as a double-encoding bug.
• Checking that a signed URL's parameters survived encoding unchanged.

Common problems and what causes them

A query parameter cut short at & or #

The value was inserted unencoded, so its own & started a new parameter and its # started the fragment. Encode values with encodeURIComponent (or build the URL with URLSearchParams) rather than concatenating strings.

encodeURI used where encodeURIComponent was needed

encodeURI deliberately leaves / ? & = # alone because they are URL structure. Applied to a value, it lets those characters through and breaks the URL. Component encoding is the right default; whole-URL encoding is the special case.

%2520 appearing in URLs

That is %20 encoded a second time - the % itself became %25. Something encoded a value that was already encoded, usually your code plus a framework or proxy doing it again. Encode exactly once, at the boundary.

Plus signs becoming spaces

In a form-encoded query string + means a space, so a Base64 value containing + arrives corrupted. Encode it as %2B, or use Base64URL which has no + at all.

Python's quote leaving slashes alone

quote() defaults to safe="/", so a value containing a slash passes through unescaped and creates a new path segment. Pass safe="" when encoding a value rather than a path.

Java's URLEncoder used for path segments

It implements form encoding, so spaces become "+" - correct in a query string, wrong in a path where "+" is a literal plus. Replace "+" with "%20" for path segments, or build a URI object.

Assuming encoding sanitises input

Percent-encoding makes a value safe to transport in a URL. It does not make it safe to interpolate into SQL, HTML or a shell command - each of those needs its own escaping.

FAQ

encodeURI or encodeURIComponent - which should I use?

encodeURIComponent for any individual value going into a query parameter or path segment, because it escapes the structural characters / ? & = # too. encodeURI only for a complete, already-well-formed URL where you want that structure preserved. When in doubt, component.

Why does my URL parameter get cut off?

Its value contained an unencoded & (which starts a new parameter) or # (which starts the fragment). Encode the value, or build the URL with URLSearchParams so it cannot happen.

Why did my plus sign turn into a space?

In a form-encoded query string, + is the legacy encoding for a space. If you need a literal plus - in a Base64 value, for instance - encode it as %2B, or switch to Base64URL, which uses - and _ instead.

What does %2520 mean?

A double-encoded space. %20 was encoded again, so its % became %25. It means a value was percent-encoded twice, typically once by your code and once by a framework or proxy.

Do I need to encode non-ASCII characters?

Yes for correctness and interoperability. They are encoded as their UTF-8 bytes, so one character can become several escapes - é is %C3%A9. Modern browsers display internationalised URLs unencoded but transmit them percent-encoded.

Is URL encoding a security measure?

No. It only makes a value safe to carry inside a URL. Preventing injection into SQL, HTML or a shell requires the escaping appropriate to each of those contexts.

Does this encode the whole URL or just a component?

It encodes/decodes a single component (like a query value), matching encodeURIComponent - characters such as :/?# that are meaningful in a full URL are also escaped, so don't run a complete URL through it expecting the scheme and slashes to survive.

Is this the same as Base64?

No. Base64 re-encodes bytes into a fixed alphabet; URL/percent-encoding only escapes characters that aren't safe inside a URL, leaving the rest of the text readable.

Related reading

• What is Base64 encoding?
• Base64URL vs Base64
• Encoding is not encryption
• Common encoding problems in APIs
• How to URL-encode query strings
• Base64 converter for binary values