URL Encoder & Decoder

Safely encode URL parameters or decode complex links locally.

Input Text or URL

0 chars

Drop a .txt file or click to browse

Method

Encodes everything except letters, digits, and - _ . ! ~ * ' ( )

Result

Understanding URL Encoding

URLs can only be sent over the internet using the ASCII character set. If a URL contains spaces or special characters (like ? or &), it can break the link. URL Encoding replaces these unsafe characters with a "%" followed by two hexadecimal digits.

Safe & Private Decoding

Using our URL Decoder, you can paste messy, percent-encoded links and instantly read the actual parameters. Because ZeroServer runs entirely client-side, you can safely decode proprietary or sensitive links without fear of tracking.

Built and maintained by Meet Shah · Last updated 25 July 2026

What this tool is used for

Building a query string by hand for a curl command, where one unencoded ampersand silently splits a single parameter into two.
Working out why a redirect URL passed as a parameter loses everything after its own question mark.
Decoding a logged request URI to read the search term a user actually typed, punctuation included.
Encoding a filename containing spaces or brackets for a download link a CDN will accept without rewriting.
Checking whether a signature mismatch is caused by the payload being encoded twice somewhere in the chain.

How it works in practice

A worked example

You are appending a search term and a return path to a URL by hand, and the request keeps arriving at the server with the wrong parameters.

Input

?next=/orders&q=t-shirt (men's) 50%

Output

encodeURIComponent   %3Fnext%3D%2Forders%26q%3Dt-shirt%20(men's)%2050%25
encodeURI            ?next=/orders&q=t-shirt%20(men's)%2050%25
Raw %XX (all chars)  %3F%6E%65%78%74%3D%2F%6F%72%64%65%72%73%26%71%3D%74%2D…

Only the middle row is still a URL. The first escaped the question mark, both equals signs, the ampersand and the slash into percent sequences, which is exactly right for one value and fatal for a whole query string. The second left all four doing their structural job — and left the user's own punctuation structural too, which is the actual bug: an ampersand typed into a search box survives, splits the parameter in two, and the return path arrives truncated. The third escaped every byte including plain letters, turning 35 characters into 105.

The edge case that catches people

The component form deliberately leaves five characters alone that RFC 3986 treats as reserved sub-delimiters: an exclamation mark, an apostrophe, both parentheses and an asterisk. Hand it a string of nothing but unreserved characters and those five, and the whole thing comes back unchanged. That is legal and harmless almost everywhere, right until something recomputes a signature over the same value — OAuth 1.0 and several cloud request-signing schemes mandate strict encoding, so their canonical string carries percent sequences where the browser left literals, and the two signatures then simply never match.

When not to use this tool

Your own code should not be doing this by string concatenation at all. The URL and URLSearchParams objects know which part of a URL they are standing in, so they encode each piece by the right rules and remove the chance of picking the wrong function; a form body wants URLSearchParams or FormData, which also handle the plus-for-space convention correctly. Use this page to read a logged request, or to work out which layer in a chain encoded something twice. Use the platform objects for the code that ships.

Frequently Asked Questions

Why does a space become %20 in a URL?: URLs may only contain a safe subset of ASCII. Spaces and many other characters must be percent-encoded as %HH (hex byte value). Space = ASCII 32 = 0x20 → %20. In HTML form data, spaces are also encoded as +.
What's the difference between encodeURIComponent and encodeURI?: encodeURIComponent encodes everything except letters, digits, and -_.!~*'() — ideal for individual parameter values. encodeURI preserves URI structural characters (/ : ? & =), suitable for encoding a complete URL.
Should I encode my entire URL or just the query parameters?: Encode only the values within query parameters (encodeURIComponent). Encoding the full URL with encodeURI is correct when you have a complete URL whose path structure you don't want to break.
How do I decode a URL-encoded string in JavaScript?: Use decodeURIComponent('encoded+string') for query parameter values, or decodeURI() for full URLs. Both throw URIError on malformed sequences — always catch errors when decoding untrusted input.
Why does + sometimes mean space and sometimes a literal plus sign?: In application/x-www-form-urlencoded (HTML form posts), + means space. In standard percent-encoding (RFC 3986), + is a literal plus and space is %20. Use %20 for spaces when you need format-agnostic encoding.
Which characters must never be encoded?: The reserved delimiters when they are acting as delimiters — encoding the `/` between path segments or the `?` before a query changes the URL's structure rather than escaping a value. Encode within components, not across them.

Common errors and gotchas

Encoding the whole URL, which turns `://` into `%3A%2F%2F` and yields a string no client will fetch. Encode the values, never the structure.
Double encoding, where `%20` becomes `%2520` and the receiving end reads a literal percent-two-zero as part of the value.
Treating `+` as a space outside a form body. In a path segment it is a literal plus, and decoding it as a space corrupts the value.
Forgetting that `#` inside a parameter ends the URL as far as the browser is concerned, so everything after it never reaches the server.
Assuming a slash inside a parameter is always safe. Path-based routers and some proxies normalise it away before your code sees it.