URL Encoder and Decoder
Encode and decode URLs and query parameters, with a breakdown of every part of the address.
Processed on your device — no upload
Escaping a single value and escaping a whole address are different jobs. Run a full URL through the first and you get one long unusable string.
How to use it
- Choose encode, decode or inspect.
- Paste the URL or the value.
- Copy the result.
How it works
A URL may only contain a restricted set of ASCII characters. Everything else — a space, an Arabic letter, an ampersand inside a value — is written as a percent sign followed by the hexadecimal value of each byte. A space becomes %20; the Arabic letter ق is two bytes in UTF-8 and becomes %D9%82.
The choice that matters is how much to escape. Escaping a single value escapes everything, including : / ? # &, because inside a value those characters are just text. Escaping a whole address leaves that punctuation alone, because there it is structure. Running a complete URL through the first produces one long unusable string, and it is the most common mistake made with these functions.
The plus sign is genuinely ambiguous. In a query string built by an HTML form, + means a space. In a path, it means a literal plus. Nothing in the URL tells you which — only where it appears — so decoding here lets you say which you meant.
Inspecting a URL uses the browser's own URL parser: the same code that would resolve the address if you followed the link, rather than a regular expression that approximates it.
A worked example
Switch to Inspect a URL and press Load a sample. It holds a shop link with a size variant and five extra parameters. The breakdown separates them: one variant=250g that changes what the page shows, and utm_source, utm_medium, utm_campaign and fbclid that change nothing at all.
Those four exist to identify you. The utm_ parameters tell the shop's analytics which campaign you came from. fbclid is Facebook's click identifier, added to every link leaving the platform, and it ties the visit back to your account. Delete them and the page loads identically — which is exactly what the cleaned link in the result box is.
Why this is worth doing before you share a link. Forwarding a URL with an fbclid or an mc_eid still attached passes along an identifier created for you. When someone else opens it, their visit is recorded against your identifier. The email variants are the worst offenders, because a mailing list identifier usually maps directly to an email address.
Now try encoding. Paste size=250g¬e=100% arabica as a single value and you get size%3D250g%26note%3D100%25%20arabica — the & is escaped so it cannot be read as a separator, and the bare % becomes %25, which is what stops a stray percent sign from breaking the address.
If you are working with tokens rather than links, the JWT decoder and the Base64 tool handle the URL-safe Base64 that sits inside them.
Questions
What is the difference between the two encoding modes?
Escaping a single value escapes : / ? # and & as well, because inside a value they are text. Escaping a whole address leaves them alone, because there they are structure. Use the first for one parameter, the second for a complete link.
Why did my encoded URL stop working?
Almost always because a whole address was escaped as if it were a single value, so the slashes and question mark became %2F and %3F. Encode only the value that needs it.
Does + mean a space?
In a query string produced by an HTML form, yes. In a path, no — there it is a literal plus. This tool lets you choose, because the URL itself does not say.
What is double encoding?
Encoding text that was already encoded, so %20 becomes %2520. The result looks valid but decodes once to %20 rather than to a space. This tool tells you when it sees it.
Are utm parameters harmful?
Not dangerous, but they are analytics identifiers rather than part of the address. Removing them loads exactly the same page and stops a link you forward from reporting back against your visit.
Why does Arabic turn into so many percent signs?
Because each Arabic letter is two bytes in UTF-8 and each byte becomes its own escape. It is correct, and every browser turns it back into the original text.
Is my URL sent anywhere?
No. The encoding, decoding and parsing all run in this page. That matters when the URL contains a session token or a password reset link — pasting one into a server-side tool discloses it.
Should I escape ! and ( ) too?
The browser leaves them alone, but RFC 3986 reserves them and some older servers treat them as delimiters. Escaping them is always safe, so the strict option does it.