URL Encoding Explained (Encode & Decode Online Free)

Broken links often come from an unencoded &, a raw space, or a # inside a query value. URL encoding (percent-encoding) fixes that by turning unsafe characters into % plus two hex digits. Our URL Encoder/Decoder lets you encode and decode strings in the browser while building or debugging links.

Which characters need encoding?

In query parameter values, encode:

• Spaces (as %20 or + in form style)
• & = ? # when they are data, not syntax
• Non-ASCII letters and emoji
• Slashes if they are part of the value, not the path

Paths and domains follow different rules. When in doubt, encode the parameter value only.

encodeURI vs encodeURIComponent

Example: search query cats & dogs:

https://example.com/search?q=cats%20%26%20dogs

Only the value after q= was encoded with component rules.

Step-by-step: encode a query string

Building https://shop.test/search?q=red shoes&sale=50%:

1. Open URL Encoder/Decoder.
2. Paste red shoes into encode - get red%20shoes.
3. Paste 50% for sale - percent sign becomes %25 so it is not confused with encoding.
4. Assemble: ?q=red%20shoes&sale=50%25.

Never encode the entire URL after ? as one blob unless you know the parser expects it.

Step-by-step: decode for debugging

OAuth redirect looks wrong:

?error=access_denied&error_description=User%20cancelled%20login

Decode error_description to read User cancelled login. Use decode to inspect, then fix encoding at the source.

Common production bugs

• Double encoding - %2520 means someone encoded %20 again. Decode once, encode once.
• Raw JSON in query params - { and } need encoding; prefer POST body instead.
• Plus vs space - Server expects %20 but client sent +.
• Hash fragments - # starts the fragment; never put secrets after # in server-visible logs.

URL encoding vs Base64

JWTs use Base64URL (variant). Query params use percent-encoding. See Base64 guide for the other tool.

Security note

Encoding is not hiding. Tokens in URLs end up in browser history, server logs, and Referer headers. Prefer POST + body or headers for secrets.

Try the tool

Encode parameter values before shipping marketing links. Decode when analytics show %20 everywhere and you need readable reports. URL Encoder/Decoder runs locally. More on Developer Tools.