PrivateTools
Developers

URL Encoder / Decoder

Encode or decode URL components and full URIs — instant client-side conversion.

100% client-side — your data never leaves this tab

Loading tool…

What is URL Encoder / Decoder?

URL Encoder/Decoder converts unsafe URL characters to percent-encoded format and back. It helps developers build reliable query strings, callback URLs, and API parameters.

URL encode/decode operations run in-browser; input data is not uploaded.

How to use URL Encoder / Decoder

  1. 1Choose Encode or Decode mode.
  2. 2Select whether input is a full URI or a component value.
  3. 3Paste the text, URL, or query parameter.
  4. 4Run conversion and copy the transformed result.

Examples

Encode query component

name=John Doe & city=New Delhi -> name%3DJohn%20Doe%20%26%20city%3DNew%20Delhi

Decode URL

https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dtest%2520case -> https://example.com/search?q=test%20case

Tips & common mistakes

  • Use component encoding for query values, not entire already-formed URLs.
  • Avoid double encoding (`%` becoming `%25`) unless specifically required.
  • Keep UTF-8 handling consistent for international text and emojis.

Who uses this tool?

  • Building safe redirect/callback URLs for OAuth flows.
  • Encoding user search terms before appending to query strings.
  • Debugging broken links caused by reserved characters.

Frequently asked questions

What is URL percent encoding?
It replaces unsafe characters with `%` followed by hexadecimal byte values, ensuring URLs remain standards-compliant.
When should I use encodeURIComponent vs encodeURI?
Use encodeURIComponent for individual query/path pieces, and encodeURI for full URI strings that already include separators.
Why does my decoded text still contain `%20`?
It may be double-encoded. Decode once more only if you are sure the source was encoded multiple times.
Can I encode non-English characters safely?
Yes. UTF-8 characters are encoded into URL-safe byte sequences.
Does URL encoding improve security?
It improves transport correctness, not security. You still need validation, sanitization, and auth controls.