URL Encoding Explained: When to Encode the Whole URL vs One Value
A URL can only safely carry a limited set of characters. The moment a link contains a space, an ampersand, a question mark inside a value, or a non-English character, something has to give: either the character is percent-encoded — turned into a % followed by two hex digits, like %20 for a space — or the link breaks, silently means something else, or gets rejected by the server. This tool does that conversion both ways, in your browser. Encode a single query value, encode a whole URL without destroying its structure, decode a pasted link back to readable text, or paste a full URL into the query parser to see every parameter split apart. It uses the same built-in functions browsers use, so the results match what your code and your server will actually do.
How to use the URL Encoder & Decoder
- 1
Choose what you are converting
Pick Encode or Decode, then pick the scope. 'One value' is for a single query value, a path segment, or any fragment that must be fully encoded. 'A whole URL' is for a complete link whose : / ? & = and # characters must stay intact. The wrong scope is the most common encoding bug, so the tool labels which function it used in the explanation under every result.
- 2
Convert and check the result
Type or paste your text and hit Convert. Encoding turns hello world & friends? into hello%20world%20%26%20friends%3F as a single value. Decoding reverses it. If decoding fails, the tool does not guess — it tells you the input contains a malformed percent sequence, such as a lone % or %ZZ, and what a valid sequence looks like.
- 3
Parse a query string apart
Paste a full URL into the query parser to see each parameter on its own row: the parameter name, the raw encoded value exactly as it travels over the wire, and the decoded value. That side-by-side view is how you spot the usual suspects — a value that was double-encoded (%2520 instead of %20), an ampersand that split one value into two parameters, or a plus sign that a form turned into a space.
Why privacy matters with URL encoders
URL encoders look harmless, which is why people paste live links into them without thinking: pre-signed download URLs, password-reset links, UTM-tagged campaign URLs, API endpoints with tokens in the query string. A converter site that logs what you paste now holds working links to your private content, and some of them are indexed, shared, or kept indefinitely. This tool runs encodeURIComponent, encodeURI, decodeURIComponent, and decodeURI locally in your tab, so the link you are working on never leaves your device. Local conversion is also more accurate than many web encoders: because it uses the browser's own functions, a result here decodes identically in your code, in your server framework, and in the next tool on this site — no dialect differences, no surprises when the link goes live.
Who is this for?
Built for developers building links, UTM parameters, and API queries, and for marketers, support staff, and anyone who has ever pasted a broken link with %20 in it and wondered what went wrong.
encodeURI vs encodeURIComponent: the one distinction that matters
JavaScript has two encoding functions because a URL has two kinds of characters: structure and content. encodeURI is for a complete URL. It encodes spaces and unsafe characters but leaves the structural characters alone — : / ? & = # — so https://example.com/search?q=hello world stays a working link with only the space encoded. Use it when you already have a full URL that needs tidying up.
encodeURIComponent is for one piece inside a URL: a single query value, a path segment, a form field. It encodes everything except letters, digits, and - _ . ! ~ * ' ( ), including & = ? and / — because inside a value, those characters are data, not structure. Encoding a whole URL with encodeURIComponent would turn its : and / into %3A and %2F and break it; encoding a single value with encodeURI would leave its & unencoded, splitting one value into two parameters at the server. The rule is simple: encode each value as you build the URL, and encode the finished URL only if it still contains unsafe characters.
Two related traps are worth knowing. First, a plus sign means a space only in form-encoded data (application/x-www-form-urlencoded, the format browsers use to submit forms); in a normal URL, + is literally a plus, and encodeURIComponent correctly produces %20 for a space. If a server reads your %20 as expected but your + as a plus, that is why. Second, encoding is not encryption and not security: anyone can decode a percent-encoded string in one step, so never encode a password, token, or secret and treat it as protected — encoding only makes text safe to transport, not safe to read.