ToolBit

URL Encode and Decode

Percent-encode text and URLs or decode them back, in your browser.

Runs in your browser. Nothing is uploaded.

Type or paste into either field and the other updates. Text is encoded as UTF-8, so accented letters and emoji become %XX sequences. Mode picks the rules: Component escapes everything except A-Z a-z 0-9 - _ . ~ ! ' ( ) *, Whole URL also keeps ; , / ? : @ & = + $ # so a full address stays usable, and Form follows application/x-www-form-urlencoded, where a space becomes +. Strict RFC 3986 additionally escapes ! ' ( ) *.

When Text holds an absolute URL such as https://user@example.com:8080/a?x=1#top, a breakdown appears under the fields: scheme, username, password (hidden until you press Show), host, port, path, fragment, and every query parameter as a decoded key and value with its own Copy button. Repeated keys and empty values each get a row.

Example

Mode Component, Text field: Zoë & Co/50%

Zo%C3%AB%20%26%20Co%2F50%25

ë is two UTF-8 bytes (%C3%AB), and the space, &, / and % are escaped because they would otherwise be read as URL syntax. In Form mode the same text gives Zo%C3%AB+%26+Co%2F50%25.

Encode URLs in code

encodeURIComponent matches Component mode. URLSearchParams matches Form mode.

encodeURIComponent("Zoë & Co/50%");
// "Zo%C3%AB%20%26%20Co%2F50%25"

new URLSearchParams({ q: "Zoë & Co/50%" }).toString();
// "q=Zo%C3%AB+%26+Co%2F50%25"

quote leaves / unescaped unless you pass safe="". It escapes ! ' ( ) *, like Strict mode.

from urllib.parse import quote, quote_plus, urlencode

quote("Zoë & Co/50%", safe="")
# 'Zo%C3%AB%20%26%20Co%2F50%25'
quote_plus("Zoë & Co/50%")
# 'Zo%C3%AB+%26+Co%2F50%25'
urlencode({"q": "Zoë & Co/50%"})
# 'q=Zo%C3%AB+%26+Co%2F50%25'

Limitations

  • Each field is limited to 1 MB (1,000,000 UTF-8 bytes). Inputs over 100,000 characters convert shortly after you stop typing.
  • Decoding fails at a % not followed by two hex digits (write %25 for a literal percent) and at invalid UTF-8. The error gives the position and the other field keeps its previous value. Text with a lone surrogate cannot be encoded.
  • Form mode keeps line breaks as typed; a browser form submit would turn them into CRLF.
  • Whole URL mode always escapes [ and ], so an IPv6 host gets encoded. Decoding there leaves escapes for ; / ? : @ & = + $ , # as written.
  • The breakdown needs scheme://...; mailto: gets none. Parameters cannot be edited and punycode is not converted back.

FAQ

Is a space %20 or +?

%20 works everywhere. + means a space only in form data (application/x-www-form-urlencoded), which HTML forms and URLSearchParams produce. In a path, + is a literal plus.

What is the difference between encodeURI and encodeURIComponent?

encodeURIComponent escapes ; , / ? : @ & = + $ # as well, so it suits a single value inside a URL. encodeURI keeps them, so it suits a whole address. Neither escapes A-Z a-z 0-9 - _ . ! ~ * ' ( ), and encodeURI also escapes [ and ].

Which characters need encoding?

Under RFC 3986, only letters, digits and - . _ ~ are safe anywhere. Reserved characters such as / ? # & = must be escaped when they are data, not syntax. Non-ASCII characters become UTF-8 bytes, each written %XX.

What is %2520 and what does Decode again do?

%25 is an escaped %, so %2520 is %20 encoded twice. RFC 3986 says not to encode or decode a string more than once. If decoded text still contains %XX sequences, a note and a Decode again button decode it once more.

Why does a domain look like xn–?

DNS names are ASCII. A label with non-ASCII characters is stored as punycode with the xn-- prefix (an A-label in IDNA). The breakdown shows the host in that form; percent-encoding does not apply to hosts.