TH
ToolHub Pro
Security Tools

URL Encoder / Decoder

Encode special characters for use in URLs or decode percent-encoded strings. Runs entirely in your browser.

By ToolHub Pro Editorial Team, verified against NIST & IETF standards·Updated 2026-08-24

Encoded result will appear here.

Why URLs Need Encoding

URLs can only contain a limited set of ASCII characters. Characters outside this set — spaces, special symbols, non-ASCII Unicode — must be percent-encoded before inclusion in a URL. Without encoding, a URL containing a space would break because HTTP parsers treat spaces as delimiters. Special characters like &, =, ?, and # have structural meaning in URLs — using them in query parameter values without encoding causes the URL parser to misinterpret the structure.

Percent-Encoding Explained

Percent-encoding replaces each byte of the character's UTF-8 representation with a % followed by two hex digits. A space becomes %20; an ampersand becomes %26; a non-ASCII character like é (U+00E9) is encoded as two bytes in UTF-8 (0xC3 0xA9), becoming %C3%A9. JavaScript's encodeURIComponent() encodes everything except unreserved characters (letters, digits, -, _, ., ~). Use it for encoding query parameter values. encodeURI() preserves structural characters like /, ?, and & — use it for encoding full URLs, not individual parameter values.

Common Developer Pitfalls

Double-encoding is the most common URL encoding bug: encoding an already-encoded string converts %20 into %2520 (encoding the % itself). Always decode before re-encoding. Forgetting to encode query parameter values when constructing URLs programmatically causes broken links when values contain & or =. Use URLSearchParams in JavaScript to construct query strings — it handles encoding automatically and is less error-prone than manual string concatenation.

Sources

  1. IETF RFC 3986 — Uniform Resource Identifier (URI): Generic Syntax
  2. MDN Web Docs — encodeURIComponent()
  3. WHATWG — URL Living Standard

ToolHub Pro Editorial Team

Security Standards Reviewers · verified against NIST & IETF standards

Security tools are implemented and checked against published specifications, including NIST SP 800-63B password guidelines, FIPS 140-3 cryptographic module requirements, and the IETF RFCs covering encoding, hashing and key generation (RFC 4648, RFC 6234). Referenced standards are listed on each tool page.

Reviewed by ToolHub Pro Editorial Team, reviewed implementations against NIST, FIPS & IETF references

Editorial standards →

Frequently Asked Questions

What is the difference between encodeURI and encodeURIComponent?
encodeURIComponent encodes all characters except letters, digits, and - _ . ~ — making it correct for encoding individual query parameter values. encodeURI preserves structural URL characters like / ? & = # and is meant for encoding full URLs. Use encodeURIComponent when building query strings; use encodeURI when encoding a complete URL.
Why do spaces become %20 in URLs?
URLs can only contain certain ASCII characters. Spaces are not permitted because HTTP parsers treat them as delimiters. Percent-encoding replaces each byte with a % followed by two hex digits, so a space (byte 0x20) becomes %20. Some older systems use + to represent spaces in query strings, but %20 is the correct standard form.
What causes double-encoding errors?
Double-encoding happens when you encode a string that is already percent-encoded. The % character itself gets encoded to %25, turning %20 into %2520. Always decode before re-encoding. Use URLSearchParams in JavaScript to build query strings automatically rather than manually calling encodeURIComponent on strings that may already be encoded.
How are non-ASCII characters like Chinese or Arabic encoded in URLs?
Non-ASCII characters are first converted to UTF-8 bytes, then each byte is percent-encoded. The character é (U+00E9) encodes as two UTF-8 bytes 0xC3 and 0xA9, producing %C3%A9 in the URL. Modern browsers display the decoded form in the address bar for readability, but the underlying URL contains the percent-encoded form.

Related Tools

Base64 EncoderJWT Decoder