Skip to content
PocketDesk
Your files are processed on your device, never uploaded

URL encode and decode

  • On device
Input
Ln 1, Col 11 line0 BUTF-8

Paste, drop or open a file in Input to see the result here.

Waiting for input
  • ⌘Enter Run now
  • ⌘⇧C Copy result
  • ⌘F Find in result
  • Esc Exit full screen
  • Use Ctrl instead of ⌘ on Windows and Linux

How to encode or decode a URL

  1. Choose Encode or Decode.
  2. Choose the mode. Use Component for one value, such as a search term or a parameter, and Full URL for a whole address you want to keep working.
  3. Paste your text. The result appears as you type, and Copy puts it on your clipboard.
  4. When decoding query strings that use + for spaces, turn on Decode + as a space.

Query string table

When your input is a URL with a ? or a string such as a=1&b=2, a table appears under the result. It lists each parameter with its decoded key and value, so you can see exactly what a long tracking link or API call contains. Repeated keys appear once per occurrence, and a key with no value shows an empty cell.

What URL encoding is

URLs can only carry a limited set of characters. Anything else, such as spaces, accents, emoji or a & that is part of a value, is written as percent codes. café & tea becomes caf%C3%A9%20%26%20tea. Non-English text is first turned into UTF-8 bytes, and each byte gets a percent code.

The two modes differ in what they leave alone:

  • Component (encodeURIComponent) escapes / ? # & = : @ + $ , too. Use it for values you put inside a URL.
  • Full URL (encodeURI) keeps those characters, so https://example.com/a b?x=1 becomes https://example.com/a%20b?x=1.

Encoding a whole URL in component mode breaks it, because the colons and slashes are escaped as well.

Tips

  • Encode each parameter value separately, then join them with &. Encoding the whole query string at once also escapes the & and = that must stay.
  • Double encoding, such as %2520, happens when an encoded string is encoded again. Decode twice to see the original.
  • Encoded data in a token or a header may be Base64 instead, so try Base64 encode and decode or the JWT decoder.

Privacy

URLs often carry session IDs, email addresses and API keys. The work happens in your browser, and nothing is uploaded, stored or logged.

Questions

What is the difference between encodeURIComponent and encodeURI?

Component mode encodes every reserved character, including / ? & and =, so it suits a single value. Full URL mode leaves those characters alone so a whole address keeps working.

Why do I see %20 in a URL?

It is the percent code for a space. Each unsafe character becomes a percent sign and two hex digits of its UTF-8 bytes.

Should a space be %20 or +?

%20 is correct everywhere. The plus sign means a space only in form data and query strings, and the Decode + as a space option handles that.

Why does decoding say a percent sign is invalid?

A % must be followed by two hex digits. The message gives the line and column of the first bad one.

Is my URL sent anywhere?

No. Everything runs in your browser.

More developer tools