URL Encoder / Decoder
Percent-encode or decode a URL or a single URL component, live as you type. Nothing you type is sent anywhere.
Component vs full URI
They encode different characters.
Component encoding escapes everything that isn't safe inside a single
URL segment, including &, =, and ?, use it
for a query parameter value. Full URI encoding leaves those characters
alone since they're structurally meaningful in a complete URL, use it when encoding an
entire address rather than one piece of it.
Why encode a URL at all
URLs can only contain a limited set of ASCII characters. Spaces, accented letters,
emoji, and reserved symbols like & or # need to be
percent-encoded (like %20 for a space) so they survive being passed
around as part of a link without breaking it.
How it works
Encoding calls the browser's own encodeURIComponent or encodeURI, the same functions JavaScript code uses, so the output is exactly what a browser or HTTP library would produce. Each unsafe byte becomes a percent sign plus two hex digits of its UTF-8 encoding: a space becomes %20, and multi-byte characters expand to several escapes (é is %C3%A9).
The two encode modes exist because "encode a URL" means two different things. Component mode escapes everything that isn't a letter, digit, or a handful of safe marks, including / ? & = :. That's what you want for a single value going into a query string, otherwise an ampersand inside the value splits your parameter in two. Full-URL mode leaves the structural characters alone so a complete URL keeps working, and only escapes characters that can't appear raw at all. Using component encoding on a whole URL breaks it; using full-URL encoding on a parameter value is an injection bug waiting to happen. Pick by what you're encoding, not by habit.
Decode mode runs decodeURIComponent, with one practical extra: plus signs are converted to spaces first, because HTML form encoding (the application/x-www-form-urlencoded format you see in query strings) historically writes spaces as +. Malformed input, like a stray % not followed by two hex digits, throws a URIError that the tool catches and reports instead of showing half-decoded text. If decoding once still leaves %25xx sequences, your string was encoded twice; run it through decode again.
Both directions are single built-in function calls in your tab. The Network panel in DevTools shows no traffic while you type, so tokens and URLs with secrets in them stay on your machine.
Common questions
What's the difference between component and full URI encoding?
Component encoding (encodeURIComponent) escapes every character that isn't safe inside one piece of a URL, including &, =, and ?, the right choice for a query parameter value. Full URI encoding (encodeURI) leaves those structural characters alone since they have meaning in a complete address, use it when encoding a whole URL rather than one part of it.
Why does a space become %20 or +?
Spaces aren't valid in a URL, so they get percent-encoded as %20. Some older systems (particularly form submissions) use + instead of %20 inside query strings specifically, both mean the same thing in that context, which is why decode mode here treats + as a space.
Does this upload my text anywhere?
No. Encoding and decoding happen entirely in your browser using built-in JavaScript functions. Nothing you type is sent anywhere.