DevBolt
Processed in your browser. Your data never leaves your device.

How do I URL-encode or decode a string online?

Paste your text and click Encode to percent-encode special characters for safe use in URLs, or paste an encoded string and click Decode to restore the original. The tool handles all Unicode characters and runs entirely in your browser.

Encode special characters
Input
hello world & goodbye!
Output
hello%20world%20%26%20goodbye%21
← Back to tools

URL Encoder & Decoder

Encode and decode URL components or full URIs. Fast, private, and free.

Mode:
Encodes all special characters (for query params, path segments)

Quick Reference

Component mode uses encodeURIComponent / decodeURIComponent — encodes everything except A-Z a-z 0-9 - _ . ~ ! * ' ( ). Best for query parameter values and path segments.

Full URI mode uses encodeURI / decodeURI — preserves URL structure characters like : / ? # [ ] @ ! $ & ' ( ) * + , ; =. Best for encoding an entire URL while keeping its structure intact.

Tips & Best Practices

Common Pitfall

encodeURI vs encodeURIComponent: use the right one

encodeURI() encodes a full URL but preserves :, /, ?, #, and &. encodeURIComponent() encodes everything including those characters. Use encodeURIComponent() for individual query parameter values. Use encodeURI() only for complete URLs. Mixing them up creates double-encoded or broken URLs.

Pro Tip

Spaces can be + or %20 depending on context

In URL query strings (after ?), spaces can be encoded as + (application/x-www-form-urlencoded, used in HTML forms) or %20 (RFC 3986). In URL paths (before ?), only %20 is valid. JavaScript's encodeURIComponent uses %20. PHP's urlencode uses +. Be consistent within your application.

Security Note

Double encoding causes security bypasses

If your server decodes URL parameters twice, an attacker can bypass path traversal filters: %252e%252e%252f decodes to %2e%2e%2f then to ../. Always decode exactly once and validate after decoding. Web Application Firewalls often miss double-encoded payloads.

Real-World Example

Non-ASCII characters require percent-encoding

The URL path /users/josé must be encoded as /users/jos%C3%A9 for HTTP transmission. Modern browsers display the decoded version in the address bar, but the actual request uses percent-encoding. APIs should accept and return percent-encoded URLs to avoid encoding ambiguity.

Frequently Asked Questions

What is URL encoding and why is it needed?
URL encoding (percent-encoding) replaces unsafe characters in URLs with a percent sign followed by two hex digits. For example, a space becomes %20 and an ampersand becomes %26. It is needed because URLs can only contain a limited set of ASCII characters. Special characters like spaces, &, =, ?, #, and non-ASCII characters (accents, CJK, emoji) must be encoded to be transmitted correctly. Without encoding, these characters would be misinterpreted as URL syntax — a literal & would be read as a parameter separator instead of data.
What is the difference between encodeURI and encodeURIComponent in JavaScript?
encodeURI encodes a full URL string, preserving URL-structural characters like ://?#[]@!$&'()*+,;=. Use it when encoding a complete URL. encodeURIComponent encodes a single URL component value, converting everything except letters, digits, and -_.~. Use it for query parameter values, path segments, and fragment identifiers. Example: to encode the query value 'a=1&b=2', encodeURIComponent produces 'a%3D1%26b%3D2' (safe), while encodeURI produces 'a=1&b=2' (broken, because = and & retain their URL meaning). Always use encodeURIComponent for user-provided data in URLs.
How do I decode a percent-encoded URL?
Paste the encoded URL into DevBolt's URL Decoder and it converts percent-encoded sequences back to readable characters. In JavaScript, use decodeURIComponent() for individual values or decodeURI() for full URLs. For example, decodeURIComponent('%E4%BD%A0%E5%A5%BD') returns '你好'. The decoder handles UTF-8 multi-byte sequences, plus signs as spaces (common in form data), and nested encoding. If you see double-encoded URLs like %2520 (where %25 is the encoded percent sign), you may need to decode twice.

Related Convert Tools