URL Decode & Encode

How to decode or encode a URL

1. To decode, paste a URL or any percent-encoded text, such as caf%C3%A9%20au%20lait. The readable text appears at once.
2. For a full URL you also get its parts: protocol, host (with the Unicode form of an international domain), path, fragment and a table of every query parameter, each decoded.
3. Leave “Read + as a space” on for query strings and form data, where a + stands for a space. Turn it off for other text, where + is a plus sign.
4. To encode, choose Encode, type the text and pick how: a part of a URL (the usual choice for a query value), a whole URL, form data or strict RFC 3986.
5. Press Copy beside the result. A % that isn’t a valid code is pointed out by its position.

How percent-encoding works

A URL may contain only a small set of ASCII characters, and some of them have jobs: / separates the path, ? starts the query, & and = separate parameters, # starts the fragment. Every other character, and any of these used as plain data, is written as a percent sign followed by two hexadecimal digits — the value of one byte. That is percent-encoding, defined in RFC 3986.

A space is byte 32, hexadecimal 20, so it becomes %20. Characters beyond ASCII are first turned into their UTF-8 bytes, and each byte gets its own code: é is the two bytes C3 A9, so it becomes %C3%A9; the euro sign takes three bytes, %E2%82%AC, and most emoji four. Decoding reverses it: each code becomes a byte again, and the bytes are read as UTF-8 text. The letters, digits and - . _ ~ never need encoding; the hexadecimal digits may be upper or lower case.

encodeURIComponent, encodeURI or form encoding?

The four ways to encode differ in which characters they leave alone:

• Part of a URL is JavaScript’s encodeURIComponent. It encodes everything with a meaning in URLs, so the result is safe as a single query value or path segment — including a whole URL placed inside another URL. It keeps A–Z a–z 0–9 - _ . ! ~ * ' ( ).
• Whole URL is encodeURI. It also keeps ; , / ? : @ & = + $ #, so a complete address keeps working; use it to clean spaces and accents out of a link, never for a single value that might contain &.
• Form data is how browsers send forms (application/x-www-form-urlencoded, as in the WHATWG URL standard): spaces become +, and ! ' ( ) ~ are encoded too.
• Strict RFC 3986 is encodeURIComponent plus ! ' ( ) *, which RFC 3986 reserves — what OAuth signatures and some APIs require.

+ or %20?

Both can mean a space, but only in the query string. Form encoding writes spaces as +, which is why search engine URLs look like ?q=hello+world; RFC 3986 writes %20, and in a path a + is just a plus sign. A real plus sign in a query value has to be sent as %2B. That is why C%2B%2B decodes to “C++” while C++ decodes to a C and two spaces with the option on.

Double encoding

When already-encoded text is encoded again, each % becomes %25: a space turns into %20, then %2520. It happens when a URL passes through two systems that each encode it, such as a redirect link or tracking parameter. The decoder keeps going while percent codes are left and tells you how many layers there were: a%252520b has 3, and decodes to “a b”. Turn the option off to undo one layer at a time.

Worked example

The sample in the box is a search link: https://www.example.com/search?q=caf%C3%A9%20au%20lait&tag=%E2%98%95+hot&next=%2Fmenu%3Fpage%3D2#reviews. It holds 10 percent codes in one layer. Decoded, it reads:

https://www.example.com/search?q=café au lait&tag=☕ hot&next=/menu?page=2#reviews

The host is www.example.com and the path /search. The query parameters table shows 3 parameters: q = “café au lait”, tag = “☕ hot”, next = “/menu?page=2”. The + in the tag became a space and %E2%98%95 became the coffee cup, three UTF-8 bytes. The last value is itself a path with a query, which is why its /, ? and = were encoded: left as they are, the = would end the parameter early. The fragment, #reviews, is never sent to the server.

International domain names

Domain names with accents or other scripts travel in an ASCII form called Punycode (RFC 3492), marked by xn--. münchen.de is xn--mnchen-3ya.de, and IANA’s test domain 例え.テスト is xn--r8jz45g.xn--zckzah. Paste either form: the breakdown shows the host as browsers send it and in Unicode. Punycode isn’t percent-encoding, so a domain is never written with % codes.

Errors and odd characters

• A % without two hexadecimal digits — 50% off, or a code cut short — can’t be decoded. The message gives its position. A percent sign itself is %25.
• Bytes that aren’t UTF-8 come from old pages and systems that used a legacy character set. caf%E9 is “café” in Windows-1252 (Latin-1), and the decoder falls back to it and says so. In other languages this page tries their own legacy sets, such as Shift_JIS for Japanese.
• é instead of é means UTF-8 text was read as Windows-1252 somewhere along the way; decoding the original percent codes here gives the correct letter.

Tips and limits

• Encode each query value separately, then join them with & and =. Encoding the finished query string with encodeURIComponent would encode the separators too.
• Percent-encoding is not encryption: anyone can decode it. Never put passwords or tokens in a URL you share.
• For Base64 in URLs, such as tokens, use the Base64 decoder; to make a link scannable, the QR code generator.

Decoding and encoding run in your browser: nothing you paste is uploaded or saved, and reloading the page clears it. Links often carry session tokens or personal data, so that matters.

Frequently asked questions

Last updated: October 16, 2026