scriptiii
100% Client-Side

URL ↔ percent-encoding

URL encoder and decoder

Percent-encode a single value or a whole URL, decode escapes back to text, and see exactly how the browser splits a URL into its parts.

Parsing happens in this tab with the browser's own URL parser. The address you paste is never uploaded, which matters because URLs frequently contain tokens and email addresses.

Short answer: for one value — a search term, a filename, a query parameter — choose component; for a whole address, choose whole URL. Decoding shows the text plus a breakdown of the URL, so you can check what the server will actually receive.

Two modes, because one is wrong half the time

encodeURIComponent('a b&c') returns a%20b%26c: everything reserved is escaped, so the result is safe as a single value. encodeURI() returnshttps://e.com/a%20b?x=1&y=2 for a whole URL, leaving the syntax characters alone. Choosing the wrong one either breaks the address into pieces or leaves an& inside a parameter that then splits it.

What the breakdown shows

Warnings worth reading

Credentials in a URL (https://user:pass@host) end up in server logs, proxy logs and the Referer header. A plain http:// address sends its query string — which may include a session token — in clear text. The breakdown flags both rather than showing a tidy table and letting you assume it is fine.

URL encoding questions

What is the difference between encodeURIComponent and encodeURI?

encodeURIComponent escapes every reserved character, so the result is one safe value — use it for a query parameter, a path segment or a filename. encodeURI leaves :, /, ?, & and = alone, so the URL keeps its structure — use it when you have a whole address. Mixing them up is the most common cause of a broken link.

Why does a plus sign become a space?

In application/x-www-form-urlencoded data — HTML form posts and many query parsers — + means space. Outside that context + is a literal plus. The decoder has a switch for it rather than guessing, and the breakdown shows the decoded parameters so you can see which reading applies.

Why does decoding fail on my string?

A percent escape needs two hex digits and must form valid UTF-8. A lone % or a truncated sequence such as %E0%A4 cannot be decoded to text. The tool names the position of the broken escape instead of quietly dropping it, because a link that silently loses characters is worse than an error.

Does this tool send my URL anywhere?

No. Parsing uses the browser URL parser and the page has no upload endpoint. URLs often carry tokens, email addresses and internal hostnames, which is exactly why they should not be pasted into a server-side tool.

Can it parse a relative URL?

Yes. A value like /docs?x=1 is parsed against an inert base and reported as relative, with its path, query and fragment shown. A protocol-relative value such as //example.com/path is reported with the host it resolves to.

Related tools

Base64 encoder and decoderFor binary-safe payloads rather than URLs.JSON formatterFormat the payload a request returned.JWT decoderRead the token you found in that header.Hash generatorChecksum a download or a payload.