Encode and decode URLs

How to use it#

1. Paste the text or the URL you want to convert.
2. Choose whether it is one value or a whole URL, and whether spaces should be a plus.
3. Use the swap button to run the result back the other way, then copy it.

What percent-encoding actually protects#

A URL has structural characters that mean something: a question mark starts the query, an ampersand separates parameters, a hash starts the fragment. When one of those characters appears in your data rather than in the structure, the parser on the other end has no way to tell the difference. Percent-encoding replaces it with a percent sign and its hex value, so an ampersand inside a value arrives as %26 and is read back as data.

This is why the same string is encoded differently depending on where it sits. A search term going into a query parameter needs its ampersands and equals signs escaped. A complete address does not, because those characters are doing their structural job.

The tool offers both. Choosing one value escapes the delimiters too, which is what you want for something going into a parameter. Choosing whole URL leaves the structure alone and only escapes the characters that cannot appear in a URL at all, such as spaces and non-ASCII text.

Double encoding, and how to recognise it#

If you see %2520 in a URL, something has been encoded twice. A space became %20, then the percent sign in %20 was itself encoded to %25, leaving %2520. It usually means two layers of code both tried to be helpful, or a value was read from an already-encoded URL and passed on without decoding it first.

Decoding twice in this tool will get you back to the original, and seeing how many passes it takes tells you how many layers to remove in the code that produced it. The fix is almost always to decode once when reading the value and encode once when writing it, rather than adding another pass to compensate.

Non-ASCII text and byte length#

Characters outside ASCII are converted to UTF-8 bytes first, then each byte is escaped. An accented letter such as é becomes %C3%A9, two bytes. An emoji becomes four. This is why an encoded string is often much longer than the text that produced it, and why a field with a character limit measured in bytes will reject text that looked short enough.

Decoding reverses it, but only if the bytes form valid UTF-8. A string that was cut in half mid-character cannot be decoded, and the tool will say so rather than returning something mangled.