Encode and decode URL components. Handle special characters for query strings.
Encode and decode URL components for safe use in query strings and paths. Handles all special characters including spaces, &, =, ?, and Unicode. Pure JavaScript.
Upload your file using the tool above.
Adjust any settings to your preference.
Click the process button and wait for results.
Download your output using the download button.
Spaces are not legal in a URL, so they must be escaped. In the path portion a space becomes %20. In a query string, form submissions traditionally encode it as +. Both decode back to a space, but they are not interchangeable everywhere — using + inside a path will be read as a literal plus sign.
Whenever user-supplied text goes into a URL — search terms, filenames, email addresses in a query parameter. Characters like &, ?, =, # and / carry structural meaning, so an unencoded & silently splits your parameter in two. Encoding is also a defence against injection through crafted links.
Double encoding turns the % of an existing escape into %25, so %20 becomes %2520 and decodes to the literal text %20 rather than a space. Encode exactly once, at the point you build the URL. If a value already contains percent escapes, decode it first and confirm before re-encoding.
Yes, URL Encoder / Decoder is completely free. No signup, no account, and no watermark on outputs. A Pro tier is available for 100 AI ops/day and larger file sizes.
URL Encoder / Decoder runs entirely in your browser. Your file is never uploaded — it is read, processed and saved locally, so it never reaches our servers or anyone else's. You can disconnect from the internet after the page loads and it still works.
Encoding strategy
What is percent-encoding? Also called URL encoding, it replaces unsafe ASCII characters with a % followed by two hexadecimal digits. For example, a space becomes %20, and the emoji 🔥 becomes %F0%9F%94%A5.
Choosing the right strategy: encodeURIComponent encodes everything except unreserved characters — best for query values. encodeURI preserves all URL-structural characters. Strict RFC 3986 is required for OAuth signatures.
Privacy: All encoding and decoding runs in your browser using native JavaScript. No data is sent to any server.