URL Encoder & Decoder
Percent-encode text for safe use in URLs, or decode an encoded URL back to readable text. Free, in your browser.
🔒 Encoded in your browser. "Whole URL" preserves URL structure ( ://, /, ?, &); the default encodes every reserved character, for query values.
Make text URL-safe (or read it back)
Paste text and press Encode to percent-encode it, or paste an encoded string and press Decode to read it back. By default it encodes every reserved character (encodeURIComponent), which is what you want for a single query value. Turn on Whole URL to encode a full address while keeping its structure — ://, /, ?, & — intact (encodeURI). Two form-data toggles handle application/x-www-form-urlencoded: encode spaces as + when encoding, and treat + as a space when decoding, so %2B still round-trips to a literal +.
Strict mode additionally percent-encodes !, ', (, ) and *, which standard encoders leave raw — needed for OAuth 1.0 signature base strings and AWS SigV4 canonical requests, where those bytes must be escaped. For example, a b&c=1 becomes a%20b%26c%3D1. Decoding uses decodeURIComponent and reports an error if the input is not valid percent-encoding rather than silently mangling it. Everything runs in your browser — nothing is uploaded.
Frequently asked questions
What's the difference between Whole URL and the default mode?
The default (encodeURIComponent) escapes every reserved character, so it's right for a single query value like a search term. Whole URL (encodeURI) leaves structural characters such as : / ? & # in place, so you can encode a complete address without breaking it apart. Rule of thumb: one value → default; a whole link → Whole URL.
Should a space become %20 or +?
Both are valid, but they belong in different places. In a URL path a space must be %20, which the default produces. In an HTML form submission (application/x-www-form-urlencoded) a space is conventionally +. Turn on 'Encode spaces as +' for that form style, and 'Treat + as space' when decoding form data — an escaped %2B still decodes to a literal + either way.
What does Strict (RFC 3986) mode do, and when do I need it?
Standard encoders leave ! ' ( ) and * unescaped, even though RFC 3986 doesn't treat them as unreserved. Strict mode percent-encodes them too. You need it for signature schemes that build a canonical string byte-for-byte — OAuth 1.0 signature base strings and AWS Signature V4 canonical requests — where an unescaped * or ! would break the signature.