Percent Encoding Tool: URL Encoder and Decoder

Paste text or a URL to percent-encode it, or paste an encoded string to read it. Choose whether separators such as & ? = and / are escaped or kept.

Runs in your browserFree, no sign-upLast reviewed October 8, 2026

Encoded

https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dhello%20world%26lang%3Den

Quick answers

What is percent encoding?: It is the way URLs carry characters they cannot contain directly. Each byte of such a character is written as % followed by two hexadecimal digits, so a space is %20 and a question mark is %3F. It is also called URL encoding and is defined in RFC 3986.
What does %20 mean in a URL?: %20 is a space. 20 is the hexadecimal value of the space character (32 in decimal). A file called my file.pdf appears in an address as my%20file.pdf.
How do I percent-encode a URL?: For a whole address, encode with Full URI scope so the slashes and query separators survive: https://example.com/my file.pdf becomes https://example.com/my%20file.pdf. For a value going inside a query string, use Component scope so & and = inside it are escaped too.
How do I decode a percent-encoded string?: Paste it, set Action to Decode and keep Component scope. https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dhello%20world decodes to https://example.com/search?q=hello world. If the result still contains escapes such as %2F, it was encoded twice, so decode again.
Which characters do not need to be encoded in a URL?: The unreserved characters never need it: the letters A to Z and a to z, the digits 0 to 9, and the hyphen, full stop, underscore and tilde. Everything else is either a reserved separator, encoded when it is data, or must always be encoded.
What is the difference between %20 and + for a space?: %20 is a space everywhere in a URL. A plus sign means a space only in form-style query strings (application/x-www-form-urlencoded). This tool writes spaces as %20 and does not turn + into a space when decoding.

Why use URL Encoder & Decoder

Percent encoding replaces a character that is not allowed in a URL, or that would be misread there, with a percent sign and two hexadecimal digits: a space becomes %20, an ampersand %26 and a slash %2F. This tool does the conversion in both directions. Set Action to Encode or Decode, then choose the Encoding scope. Component escapes every separator and is right for a single value such as a search term. Full URI keeps : / ? & = # in place and is right for a whole address that only needs its spaces or accents fixed. Text is treated as UTF-8, so é becomes %C3%A9.

Percent-encoded characters chart

What each character becomes under the two Encoding scope settings. Kept means the character is left as it is.

Character	Name	Component	Full URI
(space)	Space	%20	%20
!	Exclamation mark	Kept	Kept
"	Double quote	%22	%22
#	Hash	%23	Kept
$	Dollar	%24	Kept
%	Percent	%25	%25
&	Ampersand	%26	Kept
+	Plus	%2B	Kept
,	Comma	%2C	Kept
/	Slash	%2F	Kept
:	Colon	%3A	Kept
;	Semicolon	%3B	Kept
<	Less than	%3C	%3C
=	Equals	%3D	Kept
>	Greater than	%3E	%3E
?	Question mark	%3F	Kept
@	At sign	%40	Kept
[	Left square bracket	%5B	%5B
\	Backslash	%5C	%5C
]	Right square bracket	%5D	%5D
^	Caret	%5E	%5E
`	Backtick	%60	%60
{	Left brace	%7B	%7B
\|	Pipe	%7C	%7C
}	Right brace	%7D	%7D

Letters, digits and - _ . ~ are never changed. Both scopes also leave ! ' ( ) and * alone. A line break encodes as %0A.

Encoding and decoding examples

Real results from the tool. The scope used is shown with each input.

A search term with an ampersand

shoes & socks (Encode, Component)

shoes%20%26%20socks

With Full URI scope the result is shoes%20&%20socks, and the bare & would end the parameter early.

A whole address, kept usable

https://example.com/search?q=hello world&lang=en (Encode, Full URI)

https://example.com/search?q=hello%20world&lang=en

The same address as a value inside another URL

https://example.com/search?q=hello world&lang=en (Encode, Component)

https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dhello%20world%26lang%3Den

This is the form a redirect or callback parameter needs.

A plus sign that must stay a plus

C++ tutorial (Encode, Component)

C%2B%2B%20tutorial

A literal percent sign

100% free (Encode, either scope)

100%25%20free

An email address in a query value

user@example.com (Encode, Component)

user%40example.com

JSON in a parameter

{"id":1} (Encode, Component)

%7B%22id%22%3A1%7D

Decoding a double-encoded slash

%252F (Decode, Component)

%2F

Decoding %2F once more gives /. %25 is the encoded percent sign, which is the telltale of double encoding.

Accented letters, symbols and emoji in percent-encoded form

Characters outside ASCII are first converted to UTF-8 bytes, then every byte is escaped. That is why one visible character can turn into two, three or four escapes.

Character	Encoded	UTF-8 bytes
é	%C3%A9	2
ñ	%C3%B1	2
ü	%C3%BC	2
£	%C2%A3	2
©	%C2%A9	2
€	%E2%82%AC	3
日本語	%E6%97%A5%E6%9C%AC%E8%AA%9E	9 (3 per character)
😀	%F0%9F%98%80	4

Whole words work the same way: café encodes to caf%C3%A9 and François to Fran%C3%A7ois.

Component or Full URI: which scope to use

The two scopes exist because the same character can be structure in one place and data in another. In https://example.com/search?q=a&b the ampersand separates two parameters. In a search for the phrase a&b it is part of the value and has to travel as %26.

Component scope escapes every reserved separator. Use it on one piece at a time: a query value, a parameter name, a path segment or a filename. Then assemble the address around the encoded pieces. Running it over a finished address escapes your own :// and ? as well, which is only what you want when the address is itself a value, as with a redirect_uri.

Full URI scope leaves : / ? # & = + $ , ; and @ untouched and fixes only what can never appear raw, such as spaces, double quotes and accented or non-Latin letters. Use it to tidy an address whose structure is already right.

Decoding follows the same split. Component decoding converts every escape. Full URI decoding deliberately leaves escaped separators such as %2F, %3F and %26 as they are, so the decoded address keeps the same meaning: a%2Fb%3Fc%20d decodes to a%2Fb%3Fc d under Full URI and to a/b?c d under Component.

Common percent-encoding mistakes

Encoding a whole query string with Component scope. name=John Doe&city=New York becomes name%3DJohn%20Doe%26city%3DNew%20York, which a server reads as one long value. Encode each value on its own, or use Full URI to get name=John%20Doe&city=New%20York.
Encoding twice. Running %20 through the encoder again gives %2520, and the receiving side then sees the text %20 instead of a space.
Leaving a plus sign raw in a form-style query. Many servers read + as a space, so a+b arrives as a b. Encode it as %2B.
Leaving a bare % in text that will be decoded. 100% cannot be decoded because % is not followed by two hex digits; it should be 100%25.
Expecting + to decode to a space here. hello+world decodes to hello+world. Replace + with %20 first if the text came from a form submission.

What this encoder does and does not do

Encoding uses the browser's standard encodeURIComponent and encodeURI functions and decoding uses decodeURIComponent and decodeURI, so results match what JavaScript code produces. Hexadecimal digits in the output are uppercase, as RFC 3986 recommends. Component scope leaves ! ' ( ) and * unescaped, which is valid in a URL but differs from stricter encoders that also escape those five.

Input is always read as UTF-8. Other character sets such as ISO-8859-1 are not offered, and a sequence that is not valid UTF-8, for example %FF on its own, is reported as an invalid escape instead of being guessed at. The whole box is processed as one string; there is no line-by-line mode, and a line break inside the text is encoded as %0A. Nothing you paste is uploaded, so addresses containing tokens or keys stay on your device.

How to use it

1
Paste your text, query value or address into Text or URL.
2
Set Action to Encode to produce escaped text, or Decode to turn escapes back into characters.
3
Set Encoding scope: Component (encodes & ? = /) for one value or path segment, Full URI (keeps & ? = /) for a complete address.
4
Copy the Encoded or Decoded result.
5
If decoding reports an invalid percent-escape sequence, look for a % that is not followed by two hex digits and fix or encode it as %25.

Frequently asked questions

Is URL encoding the same as percent encoding?

Yes. They are two names for the same scheme. Percent-encoding is the term used in RFC 3986, the standard for URI syntax, while URL encoding is the everyday name. Form encoding is a close relative that additionally writes spaces as plus signs.

What do %2F, %3A, %3F, %3D and %26 stand for?

%2F is a slash, %3A a colon, %3F a question mark, %3D an equals sign and %26 an ampersand. Seeing many of them together, as in https%3A%2F%2F, means a full address was encoded as a single value.

Why does decoding say the text contains an invalid percent-escape sequence?

A percent sign in the input is not followed by two hexadecimal digits, or the escaped bytes do not form valid UTF-8. Typical causes are a literal % that was never encoded, a string cut off mid-escape such as %E0%A4%A, or text encoded in an older character set.

Why are square brackets encoded even in Full URI scope?

The browser function behind Full URI scope escapes [ and ] as %5B and %5D. Brackets are only legal in a URL around an IPv6 host address, so escaping them is harmless in a path or query. If you are encoding an address with an IPv6 host, restore those two brackets by hand.

Does letter case matter in a percent escape?

No. %2f and %2F both decode to a slash, and this tool accepts either when decoding. Uppercase is the recommended form for output, and it is what the encoder writes.

Should I percent-encode a URL before putting it in an HTML link?

Encode the parts that need it so the address is valid, then apply HTML escaping for the attribute, which replaces each ampersand with its HTML entity. They are separate layers: percent escapes are for the URL, HTML entities are for the markup around it.

Can it encode several values at once?

It encodes whatever is in the box as one string. To prepare several query values, encode them one at a time with Component scope and join them with & and = yourself, so those separators stay unescaped.

Is it safe to paste URLs that contain access tokens?

The conversion happens in your browser and the text is not sent to a server. Treat the result with the same care as the original, since encoding is not encryption: anyone can decode it.