URL Encoder & Decoder
Percent-encodes and decodes URLs and query values, with a component-versus-whole-URL mode.
Percent-encodes and decodes URLs, with the four different rules that are all called "URL encoding" kept apart: `encodeURIComponent`, `encodeURI`, strict RFC 3986, and the form encoding where a space becomes `+`. Picking the wrong one is what produces a link that works until someone types a `&`.
One query value, one path segment, one fragment. `encodeURIComponent`: escapes `/ ? : @ & = + $ , #` and leaves `A-Za-z0-9 - _ . ! ~ * ' ( )`.
Text
Encoded
In
0 chars
Out
0 chars
Characters escaped
0
How to use it
Choose the scope first
Component for one query value or one path segment — that is the common case. Whole URL only for a URL you already have and just want tidied; it deliberately leaves `?`, `&` and `/` alone.
Paste and read the output
The counters under the panels show how many characters were escaped, which is a quick way to notice that you picked a scope that did nothing.
Set the byte encoding when decoding an old URL
A link from a Korean site of ten years ago percent-encoded EUC-KR bytes, not UTF-8, and decoding it as UTF-8 gives mojibake. The picker in decode mode has EUC-KR, Shift_JIS, GB18030 and the Latin-1 family.
Edit the query as fields when there are many
The "Edit as a query string" toggle splits the URL into name/value rows. Values are shown decoded and written back encoded, so a whole URL nested inside a `next=` parameter survives being edited.
Common questions
What is the difference between Component and Whole URL?
Component escapes the delimiters — `/ ? : @ & = +` — because a *value* containing them would otherwise break the URL apart. Whole URL leaves them because they are the structure. Using Whole URL on a value is the standard way to build a link that fails as soon as the value contains an ampersand.
Why does my signature not verify?
Probably because `encodeURIComponent` leaves `! ' ( ) *` alone and RFC 3986 does not. OAuth 1.0, AWS SigV4 and most other signing schemes canonicalise with the strict rule, so a value containing an apostrophe hashes differently. That is what the Strict scope is for.
What does the "encoded twice" note mean?
That decoding the result again produces something different — a `%2520` where a `%20` was meant. It usually means a value went through an encoder in the client and again in a proxy or a framework. Decode twice to get the original, then fix the pipeline.
Why is a space sometimes `+` and sometimes `%20`?
`+` belongs to `application/x-www-form-urlencoded` — form POST bodies and what `URLSearchParams` produces. Everywhere else in a URL a space is `%20`, and a `+` means a literal plus sign. Mixing them turns `a+b` into `a b` or the reverse.
Feed it from
Slug Generator
Turns a title into a URL-safe slug, with romanisation for Korean and a choice of separator.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
HTML Entity Encoder
Escapes and unescapes HTML entities, with named, decimal and hexadecimal output.
URL Parser & Query Editor
Splits a URL into its parts, shows query parameters as an editable table and rebuilds the result.
Next
These accept what this tool produces, so the result can go straight in.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
HTML Entity Encoder
Escapes and unescapes HTML entities, with named, decimal and hexadecimal output.
Punycode Converter
Converts internationalised domain names to and from punycode and warns about lookalike characters.
URL Parser & Query Editor
Splits a URL into its parts, shows query parameters as an editable table and rebuilds the result.
curl to Code
Converts a curl command into fetch, axios, Python requests, Go, PHP or PowerShell.
Text Hash
Computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 of a string, with an uppercase and Base64 output option.