URL Encode & Decode
Percent-encode or decode URLs and query parameters.
About the URL Encode & Decode
The URL Encoder & Decoder on HT99 Tools percent-encodes text for safe transport in a URL, and decodes percent-encoded sequences back to plain text. URLs are restricted to a tiny alphabet — ASCII letters, digits, and a handful of reserved characters — so any byte outside that set must travel as %XX, where XX is the hex value of the byte.
The tool exposes both encodeURIComponent and encodeURI. They differ by a small but important set of characters: encodeURIComponent encodes every reserved character (it is the safe choice for individual query parameter values), while encodeURI preserves the URL structural characters : / ? # [ ] @ ! $ & ' ( ) * + , ; = so the result remains a valid URL.
Pick the wrong scope and you get one of two failure modes: either your query value is corrupted by an unescaped & that the server reads as a parameter delimiter, or your full URL is over-encoded to a string of %2F sequences that no client will follow. The right scope depends on whether you are encoding a value or a whole URL.
The tool deliberately does not implement the +-for-space convention from application/x-www-form-urlencoded. That convention is specific to HTML form bodies and confuses query-string parsers that expect %20. Sticking to %20 for spaces matches what encodeURIComponent produces and is the right call for URL query strings.
How It Works
RFC 3986 §2 divides the URI character set into three classes. Unreserved characters (A–Z a–z 0–9 - _ . ~) never need encoding. Reserved characters (: / ? # [ ] @ ! $ & ' ( ) * + , ; =) have syntactic meaning and must be percent-encoded when used as literal data. Everything else (spaces, control characters, non-ASCII bytes) must be percent-encoded.
JavaScript's encodeURIComponent encodes everything except unreserved characters — that is what you want for an individual query value. encodeURI additionally leaves the reserved structural characters alone so the output still parses as a URL. Decoding uses decodeURIComponent, which converts every valid %XX sequence back to its byte; multi-byte UTF-8 sequences such as %C3%A9 are reassembled into the original character (é).
Spaces are encoded as %20 in URLs. The +-for-space convention belongs to application/x-www-form-urlencoded (HTML form bodies) and is not used by encodeURIComponent — this is the right call for query strings, where + should be free to mean a literal plus sign.
Worked Examples
Encoding the default URL with encodeURIComponent turns every structural character into its percent form: https%3A%2F%2Fapi.example.com%2Fv2%2Fsearch%3Fq%3Dcoffee%20mug%26filter%3Dcolor%3Aeq%3A%22navy%20blue%22%26page%3D2. Use this when you are pasting the URL into a query parameter value.
Encoding the same string with encodeURI preserves the URL structure and only encodes the spaces and embedded quotes: https://api.example.com/v2/search?q=coffee%20mug&filter=color:eq:%22navy%20blue%22&page=2. That output is still a valid URL you can hand to fetch().
For the realistic case — building the URL dynamically — you would encodeURIComponent only the values (coffee mug → coffee%20mug, color:eq:"navy blue" → color%3Aeq%3A%22navy%20blue%22) and concatenate them with the literal & separators. Decode mode reverses any of these to recover the original text.
When to Use This Tool
- Building query-string values for a
fetchoraxioscall without a serializer. - Encoding an OAuth2
redirect_uriorstateparameter that itself contains reserved characters. - Decoding a URL-encoded path segment received from an S3 presigned URL or a CDN token.
- Building a mailto link with a subject and body that contain spaces and accented letters.
- Debugging ‘400 Bad Request’ errors that turn out to be unencoded ampersands in a query value.
- Encoding internationalised path segments before they hit a server that does not speak IRI.
- Inspecting a percent-encoded
CookieorRefererheader value during a session-debug session.
Limitations & Disclaimer
The tool implements RFC 3986 percent-encoding via JavaScript's encodeURIComponent, encodeURI, and decodeURIComponent. It does not perform IDNA (Punycode) conversion of internationalised domain names — use a dedicated IDNA library for non-ASCII hostnames. The +-for-space convention from application/x-www-form-urlencoded is not applied; spaces are always %20. Decoding a malformed sequence such as %GG or a truncated %C3 (without the following byte) will throw URIError. See our disclaimer for full terms.
Frequently Asked Questions
When should I use encodeURIComponent vs encodeURI?
Use <code>encodeURIComponent</code> for any value being placed into a query string, path segment, or fragment — anywhere the encoded text is a value, not a URL. Use <code>encodeURI</code> only when you are encoding a full URL that already has the correct structure and you want to keep <code>://</code>, <code>/</code>, <code>?</code>, and <code>&</code> intact. The rule of thumb: <code>encodeURIComponent</code> for values, <code>encodeURI</code> for whole URLs.
Should spaces be %20 or +?
In URLs, use <code>%20</code>. The <code>+</code>-for-space convention is defined by the <code>application/x-www-form-urlencoded</code> media type (HTML form POST bodies and <code>application/x-www-form-urlencoded</code> query strings). Mixing the two is legal but confusing; <code>decodeURIComponent</code> will not convert <code>+</code> back to space, which is the most common reason a value arrives with literal <code>+</code> signs in it.
What characters are unreserved (never encoded)?
RFC 3986 §2.3 lists <code>A–Z</code>, <code>a–z</code>, <code>0–9</code>, <code>-</code>, <code>_</code>, <code>.</code>, and <code>~</code>. These seven punctuation characters were chosen because they have no syntactic meaning in any URI component, so encoding them would only inflate the URL without changing its semantics.
How are non-ASCII characters encoded?
Each character is first converted to UTF-8 bytes, then each byte is percent-encoded. The character <code>é</code> (U+00E9) is two bytes in UTF-8 (<code>0xC3 0xA9</code>), so it becomes <code>%C3%A9</code>. A four-byte emoji such as 😄 (U+1F604) becomes <code>%F0%9F%98%84</code>. Both uppercase and lowercase hex digits are accepted on decode, though uppercase is canonical.
Can I decode a string that was double-encoded?
Yes, but you must run <code>decodeURIComponent</code> once per layer. A double-encoded space is <code>%2520</code> (the <code>%</code> of <code>%20</code> was itself encoded to <code>%25</code>). The first decode yields <code>%20</code>; the second yields a literal space. This tool decodes one layer per click; click again to strip the next layer.
Is my text uploaded anywhere?
No. Encoding and decoding run in your browser. URLs that contain API keys, session tokens, or PII never leave the device.
Last updated: September 9, 2026 · Author: HT99 Tools Editorial Team