URL Encode and Decode

Percent-encode text so it survives being put in a URL, or decode it back to readable form. The tool makes the choice most others hide: whether you are encoding a single value, where characters like & and ? must be escaped, or a whole URL, where they must not. Nothing is sent to a server.

Why URLs need encoding at all

The URL standard permits a small set of characters: letters, digits, and a handful of symbols. Everything else has to be escaped. Some characters are excluded because they are unsafe in transit — spaces get mangled, quotation marks get eaten by shells. Others are excluded because they already mean something: a question mark begins the query string, an ampersand separates parameters, a hash introduces the fragment.

Percent-encoding solves both problems the same way. Take the character's UTF-8 bytes, write each as two hexadecimal digits, and prefix each with a percent sign. The result contains only safe characters, and any reader knows to reverse it.

The distinction that actually matters

Nearly every online URL encoder gives you one button and quietly picks one behaviour. That is where the bugs come from, because the right answer depends entirely on what you are encoding.

Suppose a user searches for tom & jerry. If you encode only the value, you get tom%20%26%20jerry, and the whole phrase arrives as one parameter. If you encode it as though it were a whole URL, the ampersand survives untouched — and the server reads it as the start of a second parameter. The search silently becomestom, and nobody notices until someone reports that results are wrong.

The reverse mistake is just as common. Encode a complete address with the single-value option and every slash and colon becomes an escape sequence, producing a string that is no longer a URL at all.

Where you will meet it

Query strings and search parameters. OAuth redirect URIs, which must be encoded when passed as a parameter to an authorisation endpoint. API requests carrying filters or dates. Analytics campaign tags. Anywhere a value that might contain punctuation has to travel inside an address.

It also shows up in reverse when you are debugging: a log line full of %2F and%3A is far easier to read once decoded, which is often the reason people reach for a tool like this in the first place.

Privacy

Everything happens in your browser. The page is static, there is no backend and no request leaves your device. Given how often the URL being decoded contains an access token, a session identifier or a customer's search terms, that is the point rather than a bonus.