Why does my query string break with & characters?

The & character separates key=value pairs in a query string, so a literal & inside a value gets interpreted as a new parameter. If you send ?msg=Tom & Jerry, the server sees msg=Tom plus a nameless second parameter. Encode the value with encodeURIComponent so it becomes ?msg=Tom%20%26%20Jerry, and the server-side parser will decode it back to the original text.

What is the difference between %20 and + for spaces?

%20 is the RFC 3986 percent-encoding of a space and is valid anywhere in a URL. The + convention comes from the older application/x-www-form-urlencoded format used by HTML form submissions, and it only means "space" in query strings and form bodies. In a URL path, + is a literal plus sign - so decoding + as a space in the wrong context corrupts data. Use the form-urlencoded mode only when you are dealing with form payloads or query strings that were produced that way.

Why do I see %25 or double-encoded values like %2520 in my logs?

%25 is the encoding of the % character itself, so %2520 means a string containing %20 was encoded a second time. This usually happens when one layer (say, your framework) encodes a value and your code encodes it again before appending it to a URL. Decode twice with the swap button to recover the original, then find and remove the redundant encode call - double-encoding is a common cause of broken redirect URLs and failed OAuth flows.

How are non-ASCII characters like é or 日本 encoded?

JavaScript encodes them as UTF-8 byte sequences, with each byte percent-encoded: é becomes %C3%A9 (two bytes) and 日 becomes %E6%97%A5 (three bytes). This is why an encoded URL can be much longer than the original text. Both encodeURI and encodeURIComponent handle this identically; they only differ on ASCII delimiter characters.

Why does decodeURIComponent throw "URI malformed"?

A % in the input must be followed by exactly two hexadecimal digits. Inputs like "100% free" or a truncated %E6 sequence (an incomplete UTF-8 byte pair) violate that and throw URIError. This tool catches the error and tells you, rather than crashing. If your data legitimately contains raw % signs, encode it first - % becomes %25.

Can I decode a value encoded with a different URL encoder and decoder?

Yes, as long as it used standard UTF-8 percent-encoding, which is what nearly every modern encoder produces. Two cases fail. A value encoded as Latin-1, such as %E9 for é, is not valid UTF-8 and returns the malformed percent-encoding error, and the old %u00E9 style from the deprecated JavaScript escape() function fails the same way. If the other encoder used + for spaces, pick application/x-www-form-urlencoded before clicking Decode, or the + signs stay in the output.

Does this URL encoder decoder support bulk encoding, one value per line?

No, the whole Input box is treated as one string. If you paste three values on three lines, the line breaks are encoded too, as %0A, and you get a single encoded line back. To encode a list of values separately, encode them one at a time, or encode the block and split the output on %0A.

Which characters never need encoding?

RFC 3986 defines the unreserved set: letters A-Z and a-z, digits 0-9, hyphen, underscore, period, and tilde. These are safe anywhere in a URL and every encoder leaves them untouched. JavaScript's encodeURIComponent additionally leaves ! ' ( ) * unescaped even though RFC 3986 classifies them as reserved - usually harmless, but strict OAuth 1.0 signature implementations require encoding those five manually.

Is URL encoding a security measure against injection attacks?

Partially. Properly encoding user input before placing it in a URL prevents parameter injection and header-splitting via characters like &, ?, and newlines. But it is context-specific: URL encoding does nothing against XSS if the value is later rendered into HTML - that needs HTML entity encoding - and nothing against SQL injection. Always escape for the context where the data is used, not just once at the entry point.

Is this URL encoder decoder free, and does it send my URLs to a server?

It is free, no signup, and it sends nothing: encoding and decoding run entirely in your browser with the native JavaScript functions, with no network request for your text, and the tool works offline. That makes it safe to paste sensitive material like presigned S3 URLs, API keys embedded in callbacks, or session tokens you are debugging.

What characters are not allowed in a URL?

Spaces, quotes, angle brackets ( ), curly braces, backslash, caret, backtick, and the pipe character are unsafe and must be percent-encoded, along with any non-ASCII character. Reserved characters like ?, &, =, #, and / are allowed but only in their structural roles - used inside a value, they must be encoded too. When in doubt, run the value through encodeURIComponent.

Do I need to encode the whole URL or just the parameters?

Just the parts you insert - encode each query parameter value and each dynamic path segment individually with encodeURIComponent, then assemble the URL. Encoding the whole assembled URL breaks it, because the structural ?, &, and / characters get escaped along with the data. Only reach for encodeURI when you receive a complete URL from elsewhere and need to clean up spaces or unicode without changing its structure.

URL Encoder/Decoder

Encode and decode URLs, query strings, and form data with encodeURIComponent, encodeURI, or form-urlencoded modes

Mode:

Input

Output

Output will appear here...

encodeURIComponent (component)

Escapes everything with special meaning in a URL. Use for individual values - query parameters, path segments, cookie values - never for a whole URL (it would encode :// too).

EncodesReserved delimiters : / ? # [ ] @ $ & + , ; =, spaces, and all non-ASCII characters

PreservesRFC 3986 unreserved characters: A-Z a-z 0-9 - _ . ~ plus ! * ' ( )

a=1&b=2 → a%3D1%26b%3D2 (safe to embed as a single query value)

Category:encoding

Mode:Offline

Version:1.0.0

Access:Free

What is URL Encoder/Decoder?

URL Encoder/Decoder interface on Toolz.dev - Encode and decode URLs, query strings, and form data with encodeURIComponent, encodeURI, or form-urlencoded modes

URL Encoder/Decoder converts text to and from percent-encoding (also called URL encoding), the escape scheme defined by RFC 3986 that makes arbitrary strings safe to put inside a URL. Characters like &, =, ?, # and / have structural meaning in URLs - if a query-string value contains a literal "&", the server will split your parameter in half unless that character is escaped as %26. This tool gives you all three encoding variants developers run into: encodeURIComponent for individual values, encodeURI for complete URLs, and application/x-www-form-urlencoded (spaces as +) for HTML form bodies.

The distinction between modes matters more than most tutorials admit. encodeURIComponent escapes every reserved delimiter, so it is the right choice for a single query parameter, a path segment, or a redirect target embedded in another URL - but running it on a full URL would mangle https:// into https%3A%2F%2F. encodeURI preserves the delimiters (: / ? # & =) so an entire URL stays navigable while spaces and non-ASCII characters like é or 日本 still get escaped to their UTF-8 percent-encoded form. The form-urlencoded mode matches what browsers send when you submit a <form>: identical to encodeURIComponent except spaces become "+" instead of "%20" - a legacy quirk that still trips up API integrations today.

Everything runs 100% client-side in your browser using the same native encodeURIComponent, encodeURI and decodeURIComponent functions your production JavaScript uses, so results match exactly what your code will produce. Nothing you paste - OAuth callback URLs, signed S3 links, tokens, session IDs - ever leaves your machine. The decoder also catches malformed input (a stray % not followed by two hex digits throws URIError in JavaScript) and reports a clear error instead of failing silently.

A worked example shows how the three modes of this URL encoder and decoder differ on the same text. Type café & crème and click Encode with encodeURIComponent selected: the output is caf%C3%A9%20%26%20cr%C3%A8me. Switch Mode to application/x-www-form-urlencoded and Encode again, and the spaces become +, giving caf%C3%A9+%26+cr%C3%A8me. In encodeURI mode the & stays as it is, because encodeURI treats it as a URL delimiter, which is why that mode suits a whole URL and not a single value. Decode reverses any of them, but only the form mode turns + back into a space.

How to use URL Encoder/Decoder?

Paste your text or URL

Drop the raw value into the input area - a query parameter value, a full URL with spaces and unicode, or an encoded string like a%3D1%26b%3D2 you pulled from server logs and want to decode.

Pick the encoding mode

Choose encodeURIComponent for individual values (query params, path segments), encodeURI for complete URLs where :// and ? must survive, or form-urlencoded when you are building an HTML form body or debugging a POST payload with + signs.

Encode or decode

Click Encode to percent-encode the input, or Decode to reverse it. Decoding handles %XX sequences and, in form mode, converts + back to spaces. Malformed sequences produce a readable error instead of a blank output.

Copy or swap

Copy the result to your clipboard with one click, or use the swap button to move the output back into the input - handy when a value has been double-encoded (%2520) and needs a second decode pass.

Key Features

Three real-world modes

encodeURIComponent, encodeURI, and application/x-www-form-urlencoded - the three variants you meet in query strings, full URLs, and form bodies

Native JavaScript encoding

Uses the browser-native encoding functions, so RFC 3986 unreserved characters (A-Z a-z 0-9 - _ . ~) pass through untouched and UTF-8 multi-byte sequences encode correctly. Like your own JavaScript, it also leaves ! ' ( ) * unescaped, which RFC 3986 reserves

Safe decoding with clear errors

Malformed percent sequences like a stray "%" report exactly what went wrong instead of throwing an unhandled URIError

Swap input and output

One click moves the result back into the input - perfect for unwrapping double-encoded values layer by layer

Frequently Asked Questions

Use encodeURIComponent for a single value that goes inside a URL - a query parameter, path segment, or cookie value - because it escapes delimiters like &, =, / and ?. Use encodeURI only when you have a complete URL and want to escape invalid characters (spaces, unicode) without destroying its structure. Rule of thumb: if the string contains :// that should stay intact, use encodeURI; otherwise use encodeURIComponent.

Related Tools

CCE

encoding

Caesar Cipher Encoder & Decoder

Encode and decode Caesar cipher text with any shift, plus ROT13 and ROT47. Brute-force all 25 shifts to crack an unknown key.

HEE

encoding

HTML Entity Encoder/Decoder

Encode and decode HTML entities - named (&), decimal (&), and hex (&) forms, with XSS-safe special-character escaping

B64

encoding

Image to Base64 Converter

Convert images to Base64 data URIs and decode Base64 back to images.

encoding

Unicode Converter

Convert text to and from Unicode code points, HTML entities, JavaScript escapes, and CSS escapes. Emoji and astral characters handled correctly.

Comments

0 comments

No comments yet. Be the first to share your thoughts!

url encoderurl decoderpercent encodingencodeuricomponentencodeuriquery string encoderurlencodeform urlencodedrfc 3986uri escapeurl encoder decoder onlineurl encoder decoderurl encoder and decoderencoder decoder url

Learn more

Read the full URL Encoder/Decoder guide

Command Palette

URL Encoder/Decoder

encodeURIComponent (component)

What is URL Encoder/Decoder?

How to use URL Encoder/Decoder?

Paste your text or URL

Pick the encoding mode

Encode or decode

Copy or swap

Key Features

Three real-world modes

Native JavaScript encoding

Safe decoding with clear errors

Swap input and output

Frequently Asked Questions

Related Tools

Caesar Cipher Encoder & Decoder

HTML Entity Encoder/Decoder

Image to Base64 Converter

Unicode Converter

Comments

Learn more