URL Encoder & Decoder

URL encoding (also called percent-encoding) converts characters that are unsafe or reserved in a URL into a “%” followed by two hexadecimal digits representing the byte. For example a space becomes %20 and an ampersand becomes %26. It ensures a URL is transmitted correctly across browsers, servers and APIs without ambiguity.

Spaces are not allowed in URLs, so they must be encoded. The space character is byte 32, which is 0x20 in hexadecimal — hence %20. In the query-string part of a URL, a space may instead be encoded as a “+”, a convention inherited from HTML form submissions (application/x-www-form-urlencoded).

Paste the encoded URL into the Decode tab and the readable version appears instantly. Decoding replaces each %XX sequence with the character it represents. This tool also handles the “+” as space convention and warns you if the percent-encoding is malformed (for example a stray “%”).

encodeURI is for encoding a whole URL — it leaves structural characters like “:”, “/”, “?”, “&” and “#” intact so the URL still works. encodeURIComponent is for encoding a single piece of data, such as one query-parameter value — it escapes those structural characters too, so the value cannot break the URL apart. Use Component mode for parameter values and Full mode for entire URLs.

In practice the terms are used interchangeably; both refer to percent-encoding defined in RFC 3986. A URI (Uniform Resource Identifier) is the general concept and a URL (Uniform Resource Locator) is a URI that also tells you how to locate the resource. The encoding rules are identical, which is why the JavaScript functions are named encodeURI / encodeURIComponent.

Reserved characters (: / ? # [ ] @ ! $ & ’ ( ) * + , ; =), the space, the percent sign itself, and any character outside the unreserved set (A–Z, a–z, 0–9, and - _ . ~) should be encoded when they appear as data. Non-ASCII characters such as accented letters and emoji are first converted to UTF-8 bytes and then percent-encoded.

Query parameters are the key=value pairs after the “?” in a URL, separated by “&” — for example ?page=2&sort=price. They pass data to the server or application: filters, pagination, search terms, tracking tags and more. The Parser and Query Editor tabs let you view, add, edit, sort and rebuild them visually.

Open the Query Editor tab and paste your query string. The tool parses each key=value pair and outputs a JSON object, turning repeated keys (like tags=a&tags=b) into arrays. You can also go the other way — paste JSON and generate an encoded query string.

UTM parameters are tags appended to a URL so analytics tools can attribute traffic to a marketing campaign. The five standard tags are utm_source, utm_medium, utm_campaign, utm_term and utm_content. The UTM Builder tab generates correctly-formatted, shareable campaign URLs for you.

When a visitor clicks a link containing UTM tags, the analytics platform (Google Analytics, etc.) reads them and records the source, medium and campaign that drove the visit. They do not change the page that loads — they are purely informational metadata for attribution and reporting.

Use the Tracking Cleaner tab. It detects and strips known tracking tags — utm_*, fbclid, gclid, msclkid, mc_eid, igshid and dozens more — and returns a clean, shareable URL while listing exactly what was removed. This is great for sharing links without leaking campaign or click identifiers.

fbclid is the Facebook Click Identifier and gclid is the Google Click Identifier. Platforms append them automatically to outbound links so they can match a click to a conversion. They are not needed by the destination site, so removing them produces a cleaner, more private URL.

A URL-safe string contains only characters that are valid in a URL without further encoding — the unreserved set A–Z, a–z, 0–9 and - _ . ~. Any other character (spaces, &, =, /, non-ASCII) must be percent-encoded to make the string URL-safe. Encoding a value with Component mode guarantees it is URL-safe.

That is double encoding. %20 is an encoded space; if you encode that string again, the “%” itself becomes %25, turning %20 into %2520. It usually means a value was encoded twice in the pipeline. The Decode tab and Analyzer detect multiple encoding layers so you can fix the root cause.

No. URL encoding is a reversible formatting scheme with no secret key — anyone can decode it instantly. It provides compatibility, not security or confidentiality. Never rely on URL encoding to hide sensitive data; use HTTPS for transport security and proper encryption for secrets.

Yes. Characters outside ASCII are first encoded to their UTF-8 byte sequence, and each byte is then percent-encoded. So “ä” becomes %C3%A4 and an emoji becomes several %XX bytes. Decoding reverses the process and reconstructs the original Unicode text perfectly.

Use Component mode (encodeURIComponent). It escapes every reserved character — including & = ? / # — so a value containing those symbols cannot break the surrounding URL. Always encode individual parameter values, never the whole URL, with Component mode.

The HTTP standard sets no hard limit, but browsers and servers do in practice. Many browsers handle around 2,000 characters reliably, and some servers reject URLs beyond ~8,000 bytes. For SEO and shareability, keep URLs well under 100 characters where possible. The Analyzer reports the exact length.

An SEO-friendly URL is short, lowercase, uses hyphens (not underscores or spaces) to separate words, describes the content with relevant keywords, avoids excessive query parameters, and is served over HTTPS. The SEO score in the Parser tab grades your URL against these criteria and gives specific recommendations.

Use hyphens. Google treats a hyphen as a word separator (so “blue-shoes” is two words) but treats an underscore as a word joiner (so “blue_shoes” reads as one token). Hyphens therefore give search engines cleaner keyword signals. The SEO analyzer flags underscores automatically.

An open redirect happens when a site blindly forwards users to a URL supplied in a parameter (like ?redirect=https://evil.com). Attackers abuse it for phishing because the link starts on a trusted domain. The Security scanner flags parameters that carry absolute URLs so you can enforce an allow-list server-side.

Paste any URL into the Parser tab. It breaks the URL into protocol, username/password, hostname, port, path, query parameters and fragment, plus a domain breakdown (subdomain, registrable domain and TLD). It also shows a parameter table and a structured JSON view.

A full URL looks like scheme://user:pass@host:port/path?query#fragment. The scheme (https) says how to connect, the host is the domain, the optional port defaults per scheme, the path locates the resource, the query carries parameters, and the fragment points to a section within the page. The Parser visualizes each part.

The fragment, or hash, is everything after the “#”. It identifies a sub-resource such as a section anchor (#installation) and is handled entirely by the browser — it is never sent to the server. Single-page apps also use it for client-side routing.

Yes. The Bulk tab accepts one URL per line and lets you encode, decode or clean all of them in a single pass, then copy or download the results. It is ideal for cleaning a list of marketing links or batch-encoding API endpoints.

Use the Query Editor: enter or paste a base URL, then add, edit, reorder and remove parameters with the visual editor. The encoded URL is rebuilt automatically as you type, so you always have a valid, copy-ready link.

Parameter order generally does not affect how a server reads them, since they are looked up by name. However, ordering matters for caching and for generating identical URLs across systems. The Query Editor lets you sort parameters alphabetically for consistent, diff-friendly URLs.

Completely. All encoding, decoding, parsing and analysis run locally in your browser using the standard URL APIs. Your URLs are never uploaded, logged or stored on a server — so it is safe to process internal endpoints, tokens and confidential links.

Yes. Because everything runs client-side, the core features keep working after the page has loaded even without an internet connection. You can encode, decode, parse and clean URLs anywhere.

Use encodeURIComponent(value) for a single parameter value and encodeURI(fullUrl) for an entire URL. To build query strings safely, use the URLSearchParams API: new URLSearchParams({ q: "a b", page: 2 }).toString(). This tool uses exactly these standard APIs under the hood.

Use urllib.parse: quote(value, safe="") to encode a component, quote_plus(value) to use “+” for spaces, and urlencode(dict) to build a query string. To decode, use unquote or unquote_plus. These mirror the Component and Full modes in this tool.

A path parameter is part of the URL path that identifies a resource, like /users/42 where 42 is the user id. A query parameter comes after the “?” and refines or filters a request, like ?sort=name. Path parameters suit identity; query parameters suit options and filters.

Tracking parameters can leak which campaign, email or click a recipient came from, make URLs ugly and long, and sometimes tie a link back to your personal session. Stripping them yields a shorter, cleaner, more private link that still points to the same page.

Percent-encoding is the formal name for URL encoding: representing a byte as a “%” followed by its two-digit hexadecimal value. It is defined in RFC 3986 and is the mechanism that lets URLs carry reserved characters and non-ASCII data safely as plain ASCII text.

Not literally — a raw space is invalid and will break or be silently rewritten. Spaces must be encoded as %20 anywhere in the URL, or as “+” specifically within a query string. This tool flags raw spaces during validation and encodes them for you.

Inside a query string, “&” separates parameters, so a literal ampersand in a value (like a company name “Tom & Jerry”) must be encoded as %26 to avoid being read as a separator. Component mode handles this automatically — that is why you encode values, not whole URLs.

Paste a flat JSON object into the Query Editor and switch to JSON → query string. Each key becomes a parameter, array values become repeated keys, and everything is percent-encoded. Nested objects are stringified so the output stays a valid query string.

An API URL is the endpoint your code calls, often with query parameters carrying filters, tokens or search terms. Always encode each parameter value with Component mode so special characters (spaces, &, =, +) do not corrupt the request. Encode the value, then assemble the URL — never encode the whole URL with Component mode.

That usually means the bytes were not valid UTF-8, or the string was encoded with a different character set, or it was double-encoded. Try decoding once more if you see %25 sequences, and check the original encoding. The Analyzer reports the number of encoding layers to help diagnose it.

Yes, for HTTP caches and CDNs, ?a=1&b=2 and ?b=2&a=1 are different cache keys even though the server treats them the same. Normalizing parameter order (for example sorting them) improves cache hit rates. Use the Query Editor to sort parameters consistently.

Yes, completely free with no sign-up, no usage limits and no watermarks. Encode, decode, parse, build UTM links, clean tracking and process URLs in bulk as much as you like. An optional Pro tier removes ads, but every core feature is free forever.

Common actions are bound: Ctrl/Cmd + Enter swaps between Encode and Decode, Ctrl/Cmd + / opens the shortcuts panel, and native undo/redo works inside the editor. The Copy and Download buttons handle exporting your results.