Free URL Encoder / Decoder
Safely percent-encode full URLs and query strings instantly. Parse API parameters, clean up broken links, and decode complex URIs—all client-side.
Support Our Free Tools
If you find this calculator helpful, please consider supporting our work. Your contribution helps us build and maintain these free tools for everyone.
Buy me a coffeeThe Mechanics of URL Encoding (Percent-Encoding)
A URL (Uniform Resource Locator) must be transmitted over the internet using a strictly defined, limited subset of the US-ASCII character set. When a URL contains characters outside of this safe subset—such as spaces, special symbols, or non-Latin alphabet characters—those characters must be mapped into valid ASCII formats. This process is known as URL Encoding or Percent-Encoding.
During percent-encoding, an unsafe character is replaced by a % followed by its corresponding two-digit hexadecimal equivalent based on its UTF-8 encoding. For example, the most common encoding you will encounter is a blank space, which is converted to %20. Attempting to pass raw spaces or unescaped ampersands (&) in an API request will almost always result in broken links or server-side 400 Bad Request errors.
When to Encode
- Passing dynamic user input (like search queries) into a REST API endpoint.
- Embedding a URL within another URL (e.g., redirect or callback URLs in OAuth flows).
- Sending form data via GET requests where fields contain special characters like
=,?, or/.
When to Decode
- Reading complex callback URLs to extract readable JSON tokens or parameters.
- Reviewing server access logs containing percent-encoded requests.
- Extracting readable text from a deeply nested UTM parameter tracking string.
encodeURI vs encodeURIComponent
One of the most frequent mistakes developers make in JavaScript is utilizing the incorrect encoding function. Our tool allows you to toggle between both standards based on your specific use case.
1. Full URL (encodeURI)
This method is strictly used to encode a complete, functional Uniform Resource Identifier. It ensures the URL is valid while intentionally ignoring structural characters that have special meaning in a URL, such as :, /, ?, &, and =. If it encoded these, the link would completely break. Use this when you have a full link like https://example.com/search?q=my query and you just need to fix the spaces.
2. Query Parameter (encodeURIComponent)
This method is far more aggressive. It is used exclusively to encode a specific component of a URL—usually a query string parameter. It will encode structural characters like &, =, and ?. For example, if you are passing an entire URL as a parameter into another URL (like an OAuth redirect URL: ?redirect_uri=https://...), you must use encodeURIComponent so the browser doesn't mistake the redirect URL's structural parameters as belonging to the primary URL.
Reserved Characters Reference Table
Below is a quick reference table showing common reserved and unsafe characters and their corresponding percent-encoded hexadecimal values.
| Character | Name / Purpose | Encoded Value |
|---|---|---|
| Space (Blank) | %20 | |
| ! | Exclamation Mark | %21 |
| # | Hash / Fragment Identifier | %23 |
| $ | Dollar Sign | %24 |
| & | Ampersand (Query Parameter Separator) | %26 |
| ' | Single Quote | %27 |
| ( | Opening Parenthesis | %28 |
| ) | Closing Parenthesis | %29 |
| + | Plus Sign | %2B |
| , | Comma | %2C |
| / | Forward Slash (Path Separator) | %2F |
| : | Colon (Protocol Separator) | %3A |
| ; | Semicolon | %3B |
| = | Equals (Key/Value Separator) | %3D |
| ? | Question Mark (Query String Start) | %3F |
| @ | At Symbol | %40 |
Security, Privacy & Performance
When manipulating URLs containing sensitive access tokens, API keys, email addresses, or JWTs, privacy is paramount. Many online formatters process your data by sending the string to a backend server. This poses a massive security risk, leaving your proprietary keys exposed in external server logs.
This Texterfly URL Encoder / Decoder is engineered to be 100% client-side. The underlying JavaScript utilizes your browser's native engine to process the strings in real-time. Because no network requests are ever dispatched, there is zero latency, zero server payload, and absolute data privacy.
Frequently Asked Questions
Why do I see a "Malformed URI sequence" error?
This occurs when you attempt to decode a string that is not properly percent-encoded, or if the string contains a standalone percent sign (%) that is not followed by two valid hexadecimal digits. Ensure your input is a valid encoded URI.
Why is a space sometimes encoded as a "+" instead of "%20"?
Historically, spaces in the query string portion of a URL (e.g., form submissions using application/x-www-form-urlencoded) were encoded as a plus sign (+). However, in the path component of a URL, a space must be %20. Our decoder automatically handles replacing "+" with spaces to prevent errors.
Can URL encoding prevent SQL injection or XSS?
No. While URL encoding is necessary for safe data transmission over HTTP, it is NOT a security measure. The receiving server will decode the data, meaning any malicious scripts or SQL injection attempts will still execute if the backend does not sanitize the input properly.
Is percent-encoding case sensitive?
The hexadecimal characters used in percent-encoding are case-insensitive (e.g., %2A is identical to %2a). However, the unencoded characters themselves, such as the path or query parameters, are often strictly case-sensitive depending on the backend server handling the request.
How do I encode emojis in a URL?
Emojis are valid UTF-8 characters. When encoded, an emoji is translated into a sequence of percent-encoded bytes. Simply paste the emoji into our encoder, and it will output the correct, browser-safe string (for example, 😊 becomes %F0%9F%98%8A).
Explore All Tools
82 free tools — no signup required
All 82 tools are free · No signup · No ads