URL Encode/Decode

Turn text into a safe percent-encoded string for a link or query string, or decode %20-style text back to normal. Spots double encoding and breaks any URL into its parts. Runs in your browser.

Text to encode

Encode as

Try an example:

Private by design: encoding and decoding happen on your device. Nothing is uploaded or stored, and links are never opened.

How to use URL Encode/Decode

Choose Encode to make text safe to put in a web address, or Decode to turn %20-style text back into normal characters.
Type or paste into the box. The result updates as you type, and you can press Encode or Decode (or Ctrl+Enter) at any time.
When encoding, pick the style that matches where the text is going (see below). If you’re not sure, the first option is right for nearly everything.
When decoding, leave Treat + as a space ticked for form data and search URLs. Tick Decode repeatedly if the text has been encoded more than once.
Paste a whole link in Decode mode to see the URL breakdown: scheme, host, path, fragment and every query parameter, decoded, with tracking parameters labelled.
Use Copy to copy the result, or Swap to run it back the other way and check the round trip.

If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi

What is URL encoding?

Web addresses can only contain a limited set of characters. Spaces, accented letters, emoji and symbols with special meanings, such as &, ?, # and /, have to be written as a percent sign followed by two hexadecimal digits for each byte of their UTF-8 form. A space becomes %20, an ampersand becomes %26, and “café” becomes caf%C3%A9. This is called percent-encoding and is defined in RFC 3986.

Getting it wrong causes real bugs. An unencoded & inside a search term splits it into two parameters, an unencoded # cuts off everything after it, and an unencoded + can turn into a space when a server reads it.

Which encoding style should I use?

Query value or path part (encodeURIComponent): the everyday choice. Use it for a single value you’re putting into a link, such as a search term, a filename or a redirect address. It encodes everything except letters, digits and - _ . ! ~ * ' ( ).
Strict RFC 3986: the same, but also encodes ! ' ( ) *. Some APIs and OAuth 1.0 signatures need this exact form.
Form data: how browsers send HTML forms (application/x-www-form-urlencoded). Spaces become + instead of %20.
Whole URL (encodeURI): for a complete address that already has its structure. It encodes spaces and non-English characters but leaves : / ? & = # alone, so the link still works. Don’t use it for a single value, because it won’t protect an & inside it.

Double encoding and broken text

Text that’s been encoded twice shows %25, which is an encoded percent sign, for example %2520 instead of %20. It usually happens when a value is encoded by one system and again by another. The decoder spots this and offers to decode fully, telling you how many layers it removed.

If a % sequence isn’t valid UTF-8, the decoder keeps it as is instead of failing and tells you how many there were. This often means the text was encoded in an older character set such as Windows-1252, where “é” is %E9 rather than %C3%A9.

Reading the URL breakdown

Long links from emails and adverts can be hard to read. The breakdown shows where a link really points. The host is the site you’d actually visit, and international domains written in punycode (xn--…) are shown as they’d appear on screen. A username in the link is flagged, because that trick is used to disguise fake addresses. Query parameters are listed one per row, fully decoded, and common tracking parameters such as utm_source, fbclid and gclid are labelled. You can usually delete them and the link still works. To check whether a link is safe to open, use our Link X-Ray.

Privacy

Everything happens on your device. Text and links aren’t uploaded, saved or logged, and the tool never opens or fetches any link you paste, so it’s safe for private URLs, tokens and internal addresses.

Frequently asked questions

Is %20 or + correct for a space?

Both are correct in different places. %20 works everywhere. + only means a space in form data and query strings, and in a path it’s a real plus sign.

Is URL encoding a kind of encryption?

No. It only changes how characters are written, and anyone can reverse it. Don’t rely on it to hide information.

What’s the difference from Base64?

URL encoding keeps readable characters readable and only escapes the unsafe ones. Base64 turns any data into a block of letters and digits. For that, use our Base64 Encode/Decode tool.