URL Encoder
Percent-encode, decode and take query strings apart.
Take a URL apart
Paste any link to see its components and every query parameter decoded.
Query parameters
| Name | Decoded value |
|---|
What percent-encoding is
URLs may only contain a restricted set of ASCII characters. Everything else β spaces, accented letters, Chinese characters, emoji β and every character that has structural meaning in a URL must be written as % followed by the hexadecimal value of each UTF-8 byte. A space becomes %20, & becomes %26, and δΈ becomes %E4%B8%AD because it takes three bytes in UTF-8.
Skipping this step is a real bug, not a cosmetic one. A user-supplied value containing & or # silently ends the parameter and truncates everything after it, and unencoded input in a redirect target is a common source of injection vulnerabilities.
Component or whole URL?
This is the distinction that trips people up, and it maps to two different JavaScript functions:
- Component (
encodeURIComponent) escapes everything that is not unreserved, including/,?,&,=and#. This is what you want for a single query value, a path segment or a form field β anything that has to survive being embedded inside a larger URL. - Whole URL (
encodeURI) leaves the structural characters alone so the address keeps working. Use it when you are cleaning up an entire link that already has a scheme, host and query string.
Encoding a full URL with the component rule turns https:// into https%3A%2F%2F and breaks the link. Encoding a single value with the whole-URL rule leaves an & intact and breaks the query. Pick the one that matches what you are encoding.
The plus-sign problem
In application/x-www-form-urlencoded data β the format HTML forms post, and what appears in a query string β a space is encoded as + rather than %20. Elsewhere in a URL, + is a literal plus sign. That ambiguity is why a search for βC++β sometimes arrives as βC β. Tick the checkbox above when you are decoding form data, and leave it off for path segments.
Frequently asked questions
Why is one character sometimes three percent-escapes?
Because percent-encoding works on bytes, not characters. Most Latin letters take one byte in UTF-8, most CJK characters take three, and emoji take four β so π becomes %F0%9F%8E%89.
Which characters never need encoding?
The unreserved set: AβZ, aβz, 0β9, and - _ . ~. Everything else is either reserved for structure or outside the permitted range, and encoding it is always safe even where it is optional.
Is it safe to encode the same string twice?
No β that is double-encoding, and it is a frequent bug. %20 encoded again becomes %2520, which decodes back to the literal text %20 rather than a space. Encode exactly once, at the point where the value is inserted into the URL.
Are internationalised domain names handled the same way?
No. The host part uses Punycode instead β δΎγ.jp becomes xn--r8jz45g.jp. Percent-encoding applies to the path, query and fragment, not to the domain.
Does the analyser send my URL anywhere?
No. It uses the browser's built-in URL parser in this page. That also means anything sensitive in a query string β a session token, a signed download link β stays on your machine.