URL Encode and Decode: Percent Encoding Tool
Percent-encode text for URLs or decode %HH sequences back to characters. Compare component mode with full-URI mode, and see why %20 and + are not the same.
All calculation runs in your browser. Nothing you enter is sent to a server.
Results update as you type. Ctrl/Cmd+Enter copies the primary result.
Result
—
Bit view
Show the working
URL Encode and Decode applies RFC 3986 percent-encoding to text and reverses %HH sequences back to characters. Component mode encodes reserved characters such as /, ? and & so they can sit safely inside a single query parameter. Full-URI mode preserves structural delimiters so a complete address remains a usable link. Space handling offers both %20 and the form-encoding plus sign.
All encoding and decoding runs in your browser. Nothing you paste is sent to a server.
Encode text for safe use in a URL
Percent-encoding replaces unsafe or reserved bytes with a percent sign followed by two hexadecimal digits. The digits are the byte value, usually from UTF-8. Enter a string, choose component or full-URI mode, and copy the encoded result into a query string, path segment or redirect target.
Characters already in the unreserved set pass through unchanged. Everything else becomes %HH sequences in component mode. Encoding is reversible when the same rules are used on decode; mixing form-encoding plus signs with path-style %20 is the usual source of broken round trips.
Decode a percent-encoded string
Decoding finds each % followed by two hex digits, converts that pair to a byte, and rebuilds the original text with the selected character encoding. A lone % or a % with non-hex digits is an error. Plus signs can optionally be treated as spaces when the input came from application/x-www-form-urlencoded bodies.
Nested encoding appears when a value was encoded twice. Decoding once may still leave %25 sequences that represent a literal percent. Decode again only when that second layer was intentional; blind double-decoding corrupts data that contained a real % character.
Understand reserved and unreserved characters
RFC 3986 splits ASCII into unreserved characters that never need encoding in a URI, and reserved characters that carry structural meaning such as delimiters. Unreserved letters, digits and -_.~ stay literal. Reserved marks like /, ? and & must be percent-encoded when they appear as data rather than as syntax that frames the URL.
Unreserved: A to Z, a to z, 0 to 9, hyphen -, underscore _, period ., tilde ~
Reserved (gen-delims): `: / ?
Reserved (sub-delims): ! $ & ' ( ) * + , ; =
Unreserved characters stay literal. Reserved characters must be encoded when they appear as data rather than as delimiters. A question mark inside a parameter value is data; a question mark that starts the query string is structure. Mode selection is how the calculator knows which role each character plays.
Encode a whole URL versus a single parameter
Full-URI encoding, similar to JavaScript encodeURI, leaves structural characters alone so https:// and path slashes survive. Component encoding, similar to encodeURIComponent, encodes those characters so a value can sit inside a parameter without breaking the surrounding URL. Choosing the wrong mode either destroys a link or leaves delimiters that split the query incorrectly.
| Input | Full-URI style | Component style |
|---|---|---|
https://example.com/a b | https://example.com/a%20b | https%3A%2F%2Fexample.com%2Fa%20b |
red&blue | red&blue | red%26blue |
a=b | a=b | a%3Db |
Encoding an entire URL with component mode destroys it as a link: the scheme colon and slashes become %3A and %2F. Encoding a single parameter with full-URI mode leaves & and = intact, which splits the query incorrectly. Choose the mode that matches the slot the string will occupy.
Encode a slash and a question mark
The fixture string / and ? in component mode becomes %2F%20and%20%3F. The slash and question mark are reserved delimiters treated here as payload text, so each is escaped. Spaces become %20, while the letters in and are unreserved and pass through unchanged from left to right across the string.
| Character | Reason | Encoded |
|---|---|---|
/ | reserved path delimiter | %2F |
| space | not unreserved | %20 |
a, n, d | unreserved letters | unchanged |
? | reserved query delimiter | %3F |
Step through the string left to right: encode /, encode the space, pass and, encode the space, encode ?. The result %2F%20and%20%3F is safe to place in a query parameter named, for example, q. Using full-URI mode on the same string would leave / and ? literal, which is correct only when those characters are meant as structure rather than as payload text.
Understand %20 versus the plus sign
A space encodes as %20 in URI paths and in modern query strings that follow RFC 3986. HTML forms that submit as application/x-www-form-urlencoded historically encode spaces as + instead. Both conventions appear in production traffic, and treating them as identical is the most common space-encoding bug when decoding mixed inputs.
| Context | Space encoding |
|---|---|
| Path segment | %20 |
| RFC 3986 query | %20 |
| Form body / legacy query | + |
A literal plus sign in data must be encoded as %2B, or a form decoder will treat it as a space. The calculator labels which space convention is active so a decoded + is not mistaken for a plus character when form mode is on, and a %20 is not rejected when path mode is on.
Break down a URL into its parts
A typical URL has a scheme, host, optional port, path, query string and fragment, and encoding rules differ by part. Structural delimiters such as ://, /, ?, &, = and # stay literal when they frame the address.
Parameter names, parameter values and path segments that carry data are encoded individually in component mode before those delimiters join them.
https://example.com:443/search?q=a%20b&lang=en#top
└─┬─┘ └─────┬─────┘ └─┬──┘ └───────┬───────┘ └┬┘
scheme host path query fragment
| Part | Role |
|---|---|
| Scheme | Protocol, such as https |
| Host | Domain or IP, with optional port |
| Path | Resource location, slash-separated |
| Query | Parameter list after ?, joined by & |
| Fragment | Client-side location after #, not sent to the server in the request URI the same way |
Encode parameter names and values individually in component mode, then join with literal & and =. Encode path segments individually if they contain spaces or reserved characters, keeping the slashes that separate segments literal.
Read the character encoding table
The table below lists common reserved and unsafe characters with their percent forms under UTF-8 byte encoding. A space becomes %20, an ampersand %26, and a hash %23. Non-ASCII characters expand to multiple %HH units because each UTF-8 byte is encoded separately rather than as a single abstract glyph.
| Char | Percent | Notes |
|---|---|---|
| space | %20 | Or + in form encoding |
! | %21 | |
# | %23 | Fragment delimiter |
$ | %24 | |
& | %26 | Query pair delimiter |
' | %27 | |
( | %28 | |
) | %29 | |
+ | %2B | Literal plus |
, | %2C | |
/ | %2F | Path delimiter |
: | %3A | Scheme / host separator |
; | %3B | |
= | %3D | Parameter assignment |
? | %3F | Query start |
@ | %40 | Userinfo separator |
[ | %5B | |
] | %5D |
Non-ASCII text is first expressed as UTF-8 bytes, then each byte is percent-encoded. A single character may therefore expand to two or three %HH units. Character-encoding deep dives for Shift JIS and similar legacy sets live with the Base64 tool; this page links rather than repeating that catalogue.
Frequently asked questions
What is percent-encoding?
Percent-encoding replaces a byte with a % followed by two hexadecimal digits of that byte's value. It lets reserved and non-ASCII characters travel inside URLs without being read as syntax. Decoding reverses the substitution.
When should component encoding be used?
Use component encoding for a single parameter name or value, a path segment that is pure data, or any string that will be inserted next to structural delimiters. It encodes /, ?, & and = so they cannot split the URL.
When should full-URI encoding be used?
Use full-URI encoding when the input is already a complete URL and only illegal characters such as spaces should change. Structural colons and slashes stay literal so the result remains a clickable address.
Why does / and ? become %2F%20and%20%3F?
In component mode the slash and question mark are treated as data, so they encode to %2F and %3F. Spaces become %20. Letters in and are unreserved and stay as they are.
Is + the same as %20?
No. %20 is the RFC 3986 encoding for a space. + means space only in application/x-www-form-urlencoded data. A literal plus must be %2B or form decoders will turn it into a space.
What characters never need encoding?
The unreserved set: letters, digits, hyphen, underscore, period and tilde. Those characters remain literal in both modes. Encoding them still works but adds needless length.
How are non-ASCII characters encoded?
They are converted to UTF-8 bytes first, then each byte is percent-encoded. One visible character can become multiple %HH sequences. Decoding must use UTF-8 to rebuild the original text.
Does decoding twice fix a broken URL?
Only if the value was deliberately encoded twice. Otherwise the second pass corrupts literal % sequences that were part of the data. Decode once, inspect, and decode again only when %25 patterns show a second layer.
Is this the same as Base64?
No. Percent-encoding escapes characters for URIs. Base64 maps arbitrary bytes to a 64-character alphabet for transport in text protocols. Use each for its own job.
Are pasted URLs uploaded?
No. Encoding and decoding run in the browser only. Query strings that contain tokens or session fragments are not transmitted to a server by this tool.
Summary
URL Encode and Decode percent-encodes and decodes text under RFC 3986 rules, with separate modes for full URIs and individual components. The fixture / and ? becomes %2F%20and%20%3F in component mode. Spaces use %20 in URI contexts and may use + in form encoding, which is a different convention.
Reserved characters keep their meaning only when left literal as structure; encode them when they are payload. All work stays on the device.