URL Encode and Decode Tool
Encode or decode URL text by context, handle form-style plus signs and nested escapes, and check round-trip or double-encoding risks locally.{{ outputText }}
| Position | Token | Class | Code point / bytes | Copy |
|---|---|---|---|---|
| {{ row.position }} | {{ row.token }} | {{ row.classLabel }} | {{ row.code }} |
| # | Key | Value | State | Copy |
|---|---|---|---|---|
| {{ row.position }} | {{ row.key }} | {{ row.value }} | {{ row.state }} |
| Check | Status | What to review | Copy |
|---|---|---|---|
| {{ row.check }} | {{ row.status }} | {{ row.detail }} |
A URL uses punctuation to separate its parts. The colon follows the scheme, slashes divide paths, a question mark begins the query, an ampersand separates query pairs, and a hash begins the fragment. Percent-encoding lets the same characters travel as data by replacing an encoded byte with % followed by two hexadecimal digits. A space encoded as the UTF-8 byte 20, for example, becomes %20.
The correct transformation depends on where the value will be placed. Encoding a search term as one query value is different from encoding a complete URL. If a whole URL is treated as a component, its structural punctuation becomes data and the link stops behaving like the original. Form submissions add another convention: a space is commonly serialized as +, while a literal plus sign must be percent-encoded when it is data.
| Context | Typical input | Structure that remains meaningful |
|---|---|---|
| Component or query value | A search phrase, identifier, or parameter value | No URL separators are assumed inside the value. |
| Full URL | A complete link | Scheme, authority, path, query, and fragment delimiters remain structural. |
| Path | Several path segments | Slash separators remain visible while characters inside segments are encoded. |
| Form or query string | Form values or key=value&key=value pairs |
Spaces use plus signs and pair separators are handled separately. |
Decoding reverses complete percent triplets, but it can also reveal another encoded value. The string %252F becomes %2F after one pass and / after a second. Repeating the operation blindly can change data into separators, so nested decoding should stop as soon as the intended representation appears.
Encoding and decoding do not validate a destination, make a link trustworthy, or sanitize its contents. They only change representation. Preserve the original value, choose the context deliberately, and compare the inverse transformation when exact recovery matters.
How to Use This Tool:
Choose the operation and the destination context before changing advanced options. Auto detection is useful for inspection, while a pinned direction is better for repeatable work.
- Paste up to 12,000 Unicode characters into Text, URL, or query string, then choose Encode, Decode, or Auto detect. Use Line by line only when each non-empty line is an independent value.
- Select the matching URL context. Use component mode for one value, full-URL mode for a complete link, path mode when slashes must remain separators, and form or query mode for plus-as-space conventions.
Component mode applied to a complete HTTP or HTTPS URL percent-encodes its structure. Switch to Full URL when the output should remain a usable link.
- Set Decode depth from 1 to 4 only for intentionally nested input. On encoding, preserve existing
%XXtriplets only when those escapes are already correct; otherwise a literal percent sign is encoded normally. - Read Review checks before reusing the converted text. Investigate malformed percent prefixes, decoder fallback, a failed round trip, context mismatch, or a double-encoding warning.
Interpreting Results:
The converted text is ready for copying only when its separators and data still have the intended roles. The character audit explains percent-byte groups, reserved characters, plus signs, whitespace, and Unicode code points; the query ledger separates detected pairs for a readable check. Conversion and auditing remain in the browser.
- A passing Round trip means the inverse operation restored the prepared source under the current settings. It does not prove that another application uses the same parsing rules.
- Decoder fallback means a native decode rejected part of the input and a best-effort UTF-8 byte decode was used. Treat that output as inspection material.
- Double-encoding risk means the input already contained a complete
%XXtriplet while preservation was off, so its percent sign may have become%25. - A converted HTTP or HTTPS URL may be opened, but opening it contacts the destination. Verify the scheme, host, path, and query values first.
Technical Details:
Percent-encoding represents a byte as %HH, where each H is a hexadecimal digit. Non-ASCII text is first represented as well-formed Unicode and then encoded as UTF-8 bytes. The unreserved set defined by RFC 3986 consists of letters, digits, hyphen, period, underscore, and tilde; these characters normally remain literal.
Transformation Core:
The conversion follows a context-specific path rather than one universal replacement rule.
| Mode | Transformation | Special behavior |
|---|---|---|
| Encode component | Encode the complete value as UTF-8 percent bytes when characters are not safe in a component. | Strict RFC 3986 mode also escapes !, ', (, ), and *. |
| Encode full URL | Retain URL delimiters while encoding characters that cannot remain literal. | The result is representation-preserving only when the input already has the intended URL structure. |
| Encode path | Encode path data while restoring encoded slashes to literal / separators. |
A slash inside one segment cannot be distinguished from a separator after this transform. |
| Encode form or query | Encode values separately and serialize spaces as +. |
Query-string mode keeps & between pairs and the first = between key and value. |
| Decode | Convert percent-byte groups back to text for 1 to 4 passes, stopping early when a pass makes no change. | Full-URL mode protects reserved delimiters; other contexts decode them as component data. |
Auto detection selects decode when a value contains a complete percent triplet. It also selects decode for a plus sign in form-value or query-string context. Otherwise it selects encode. In line-by-line mode, each non-empty line is resolved independently, so the summary can report mixed directions.
Worked transformation paths:
| Purpose | Source | Intermediate rule | Result |
|---|---|---|---|
| Component encoding | café & tea |
é becomes UTF-8 bytes C3 A9; the space is byte 20. |
caf%C3%A9%20%26%20tea |
| Nested decoding | %252Fdocs |
Pass 1 produces %2Fdocs; pass 2 decodes the remaining triplet. |
/docs |
| Form decoding | q=coffee+grinder |
The pair boundary is kept and + is read as a space in the value. |
q=coffee grinder |
Unicode normalization is optional. NFC can compose canonically equivalent sequences, while NFKC can also replace compatibility characters. Either choice may prevent an exact character-for-character round trip even when the displayed text looks the same.
Worked Examples:
One encoded redirect value
A query value containing https%3A%2F%2Fexample.com%2Faccount needs component decoding, not full-URL decoding, because the complete link is data inside another URL. One pass reveals the nested destination while leaving the surrounding outer query untouched.
Literal plus in an email tag
In form data, email=user%2Btag%40example.com decodes to email=user+tag@example.com. A raw + would be read as a space in this context, so the literal plus must travel as %2B.
References:
- RFC 3986: Uniform Resource Identifier (URI): Generic Syntax, RFC Editor, January 2005.
- URL Standard, WHATWG.