TH
ToolHub Pro
Security Tools

URL Encoder / Decoder

Encode special characters for use in URLs or decode percent-encoded strings. Runs entirely in your browser.

By ToolHub Pro, Editorial Team — verified against NIST SP 800-63B & FIPS standards·Updated 2026-01-15

Why URLs Need Encoding

URLs can only contain a limited set of ASCII characters. Characters outside this set. spaces, special symbols, non-ASCII Unicode. must be percent-encoded before inclusion in a URL. Without encoding, a URL containing a space would break because HTTP parsers treat spaces as delimiters. Special characters like &, =, ?, and # have structural meaning in URLs. using them in query parameter values without encoding causes the URL parser to misinterpret the structure.

Percent-Encoding Explained

Percent-encoding replaces each byte of the character's UTF-8 representation with a % followed by two hex digits. A space becomes %20; an ampersand becomes %26; a non-ASCII character like é (U+00E9) is encoded as two bytes in UTF-8 (0xC3 0xA9), becoming %C3%A9. JavaScript's encodeURIComponent() encodes everything except unreserved characters (letters, digits, -, _, ., ~). Use it for encoding query parameter values. encodeURI() preserves structural characters like /, ?, and &. use it for encoding full URLs, not individual parameter values.

Common Developer Pitfalls

Double-encoding is the most common URL encoding bug: encoding an already-encoded string converts %20 into %2520 (encoding the % itself). Always decode before re-encoding. Forgetting to encode query parameter values when constructing URLs programmatically causes broken links when values contain & or =. Use URLSearchParams in JavaScript to construct query strings. it handles encoding automatically and is less error-prone than manual string concatenation.

Sources & Further Reading

Frequently Asked Questions

What is the difference between encodeURI and encodeURIComponent?
encodeURIComponent encodes all characters except letters, digits, and - _ . ~ — making it correct for encoding individual query parameter values. encodeURI preserves structural URL characters like / ? & = # and is meant for encoding full URLs. Use encodeURIComponent when building query strings; use encodeURI when encoding a complete URL.
Why do spaces become %20 in URLs?
URLs can only contain certain ASCII characters. Spaces are not permitted because HTTP parsers treat them as delimiters. Percent-encoding replaces each byte with a % followed by two hex digits, so a space (byte 0x20) becomes %20. Some older systems use + to represent spaces in query strings, but %20 is the correct standard form.
What causes double-encoding errors?
Double-encoding happens when you encode a string that is already percent-encoded. The % character itself gets encoded to %25, turning %20 into %2520. Always decode before re-encoding. Use URLSearchParams in JavaScript to build query strings automatically rather than manually calling encodeURIComponent on strings that may already be encoded.
How are non-ASCII characters like Chinese or Arabic encoded in URLs?
Non-ASCII characters are first converted to UTF-8 bytes, then each byte is percent-encoded. The character é (U+00E9) encodes as two UTF-8 bytes 0xC3 and 0xA9, producing %C3%A9 in the URL. Modern browsers display the decoded form in the address bar for readability, but the underlying URL contains the percent-encoded form.

Related Tools

Base64 EncoderJWT Decoder