URL Encoder / Decoder

URL Encoder / Decoder

A URL can only reliably carry a restricted set of ASCII characters — letters, digits, and a handful of punctuation marks that already have structural meaning (: / ? # [ ] @ ! $ & ' ( ) * + , ; =). Percent-encoding is the mechanism for smuggling everything else through: a space, a non-ASCII letter, or a structural character you want to use LITERALLY (not as a delimiter) gets replaced with a "%" followed by its two-digit hexadecimal byte value — a space becomes "%20", "&" becomes "%26", and so on. JavaScript exposes two built-in function pairs for this, and this tool deliberately keeps them as two separate modes rather than one generic "encode" button, because using the wrong one is the single most common mistake developers make with URL encoding.

"Component" mode (encodeURIComponent/decodeURIComponent) escapes EVERY character outside a small unreserved set (letters, digits, - _ . ~), including the structural characters &, /, ?, :, # and =. Use this mode for a single value you're about to splice into a URL — a query-parameter value, a path segment, a form field — precisely because it does NOT trust that value to be free of characters that would otherwise be misread as delimiters. If your query value itself contains "&" (say, a search term "rock & roll"), Component mode is the only one of the two that encodes it safely; Full URL mode would leave that "&" alone, and it would be misread as a second query-parameter separator.

"Full URL" mode (encodeURI/decodeURI) is the other case: you already have a COMPLETE, syntactically valid URL — scheme, host, path, query string and all — and just want to escape the handful of characters that aren't safe in a URL at all (mainly spaces and non-ASCII characters), while leaving every structural character (: / ? # & = etc.) exactly where it is, since those are already doing their job as delimiters. Running a whole URL through Component mode by mistake "double-encodes" or over-encodes it — every "/" and ":" gets turned into "%2F" and "%3A", producing a string that no longer works as a URL at all when pasted into a browser or an HTTP client.

Decoding can fail on malformed input in either mode: a stray "%" not followed by two hex digits, or a "%" followed by something that isn't valid hexadecimal, both throw rather than silently producing garbage — this tool surfaces that as a clear error instead of a confusing blank result. Both modes correctly round-trip Unicode text (encoded as UTF-8 bytes, each becoming its own "%XX" sequence, exactly like a browser's own address bar does), so accented letters, Cyrillic, CJK characters and emoji all convert cleanly in either direction.

Glossary

Percent-encoding

The scheme (RFC 3986) that represents a byte a URL can't carry literally as "%" followed by its two-digit hexadecimal value, e.g. a space becomes "%20".

Reserved characters

Characters with structural meaning in a URL (: / ? # [ ] @ ! $ & ' ( ) * + , ; =) — Full URL mode leaves them alone; Component mode escapes them.

Unreserved characters

Letters, digits, and - _ . ~ — the only characters both encoding modes always leave untouched, since they're always safe in a URL.

encodeURIComponent()

The JavaScript built-in behind this tool's "Component" mode — escapes every reserved character, safe for a single query value or path segment.

encodeURI()

The JavaScript built-in behind this tool's "Full URL" mode — leaves structural/reserved characters alone, for encoding a complete URL rather than one value.

Query string

The "?key=value&key2=value2" portion of a URL — each value should be Component-encoded individually before being joined with "&", never the whole query string encoded at once.

API equivalent

This tool has no API equivalent in our service — URL encoding isn't an IP-address fact, so there's nothing for our API to return here. The conversion above runs entirely on your device; nothing is ever sent anywhere. If you're looking for our IP-lookup API instead, it covers geolocation, ASN/network and threat/fraud data for an IP address:

Read the full API docs

Related tools

• All developer tools
• Base64 Encoder / Decoder
• Punycode / IDN Converter

Frequently asked questions

What's the difference between "Component" and "Full URL" modes?

Component mode escapes every reserved character (including &, /, ?, :) and is for a single value you're about to insert into a URL. Full URL mode leaves those structural characters alone and is for a whole, already-assembled URL.

Why did decoding fail?

The input contains a malformed percent-escape — a "%" not followed by exactly two valid hexadecimal digits. This is genuinely invalid percent-encoding, not a bug in the tool.

Should I always use Component mode for a query parameter value?

Yes — any single value being placed into a query string, path segment or form field should use Component mode, since it's the only one that safely escapes characters like & that would otherwise be misread as part of the URL's structure.

Does this tool handle Unicode characters, not just ASCII?

Yes — both modes encode non-ASCII text as UTF-8 bytes first, exactly like a browser's own address bar, so accented letters, Cyrillic, CJK characters and emoji round-trip correctly.

Is my text sent to a server?

No — the entire conversion runs in your browser using built-in JavaScript functions. This page makes no network request to perform it.

What happens if I encode a full URL with Component mode by mistake?

Every structural character — including the "://" after the scheme and every "/" in the path — gets escaped too, producing a string that no longer works as a URL at all. Use Full URL mode for a complete address instead.