URL Encoder & Decoder

URL encoding, also called percent-encoding, converts characters that can't appear in a URL into a sequence starting with % followed by two hexadecimal digits. For example, a space becomes %20, a question mark becomes %3F, and an ampersand becomes %26. This is required because URLs are transmitted over protocols that treat certain characters as delimiters or special commands. Every character in a URL must be from a limited set of ASCII characters.

encodeURI() is for encoding full URLs — it preserves characters that have special meaning in URLs like : // ? # & = and /. It only encodes characters that are unsafe for any URL part (including spaces, quotes, and non-ASCII). encodeURIComponent() encodes everything except A-Z a-z 0-9 - _ . ~ ! ' ( ) * ; : @ & = + $ , / ? #. Use encodeURIComponent() when encoding individual query parameter values or path segments. Use encodeURI() when encoding an already-assembled URL that you still want to remain a usable URL.

Double-encoding happens when an already-encoded URL is encoded again. For example, %20 becomes %2520 (% + 25 + 20). This happens through multiple layers of processing or proxies. Double-encoded URLs can be exploited in certain security attacks (HTTP parameter pollution), cause incorrect data interpretation, and result in non-functional links. This tool detects and warns when it spots patterns that look double-encoded.

Use encodeURIComponent() for query parameter values: encodeURIComponent('hello world') returns 'hello%20world'. For a full URL where you want to preserve its structure: encodeURI('https://example.com/path?foo=bar') returns the URL unchanged (it's already valid). Never use encodeURIComponent() on a full URL — it will destroy the scheme (https:// becomes https%3A%2F%2F) and make the URL unrecognizable.

Because spaces are not allowed in URLs. When a browser or server encounters a space in a URL component, it either truncates the URL at the space or returns a 404. Percent-encoding converts spaces to %20 so they can be transmitted safely. You might also see + used in query strings for spaces — this is a legacy application/x-www-form-urlencoded format from HTML forms, different from true URL percent-encoding.