ZumaTools

URL Encode / Decode

Type in either box and the other side updates as you go.

encodeURIComponent — escapes every reserved character, for query string values.

Plain text
Encoded

Processed on your device — nothing is sent anywhere.

How it works

  1. Choose Component mode for query string values or Full URL mode for complete addresses.
  2. Paste or type plain text in the left box to encode it, or encoded text in the right box to decode it.
  3. Copy the result with the button under either box.

Frequently asked questions

What is the difference between Component and Full URL mode?
Component mode uses encodeURIComponent, which escapes every reserved character including /, ?, & and =. It is the right choice for a single query string value. Full URL mode uses encodeURI, which keeps those structural characters intact so a complete address stays a working link.
Why do spaces become %20 instead of a plus sign?
Percent encoding defined by RFC 3986 represents a space as %20, and that is what JavaScript’s encoding functions produce. The plus sign convention only applies inside application/x-www-form-urlencoded form data. If a system expects plus signs you can replace %20 with + after encoding.
Why does decoding sometimes fail?
A percent sign in encoded text must be followed by two hexadecimal digits, such as %3F. If the input contains a stray % or a truncated sequence, decoding raises a malformed URI error. This tool catches that and shows a notice instead of breaking, so you can fix the input and continue.
How are non-English characters and emoji encoded?
Text is first converted to UTF-8 bytes and each byte becomes a %XX sequence. A character like é becomes %C3%A9 and an emoji can take four bytes, such as %F0%9F%98%80. Decoding reverses the process, so any language round-trips correctly as long as both sides use UTF-8, which every modern browser and server does.
Can I decode a URL that has been encoded twice?
Yes — run the output through the decoder a second time. Double encoding is a common bug where %20 turns into %2520 because the percent sign itself got escaped again. If you see %25 sequences in a link, that is the telltale sign; decode repeatedly until the text stops changing.

About this tool

This tool converts text to and from percent encoding, the escaping scheme URLs use for characters that cannot appear literally in an address. Spaces, ampersands, question marks, slashes and any non-ASCII character are replaced by %XX byte sequences when encoding, and turned back into readable text when decoding. Both directions work live: type or paste in either box and the other side updates with every keystroke.

The conversion happens entirely in your browser using JavaScript’s standard encodeURIComponent, encodeURI and decodeURIComponent functions — the same ones production web apps rely on. Nothing you paste is transmitted or stored, which means URLs containing session tokens, API keys or personal data stay on your device. The two modes matter: Component mode escapes everything, including the / and & that structure a URL, making it right for individual query string values, while Full URL mode preserves those separators so a complete address remains clickable.

Typical uses include building query strings by hand, preparing redirect or callback URLs that must carry another URL as a parameter, making tracking links safe to paste into ad platforms, and reading the garbled parameters in a link someone sent you. Developers reach for it when debugging OAuth flows and webhooks, where a value encoded in the wrong mode — or the wrong number of times — is one of the most common failure causes. Writers and marketers use it to check what a long UTM-tagged link actually contains.

Two tips save the most time. First, when a URL is a parameter inside another URL, encode the inner one with Component mode; otherwise its own ? and & will be misread as belonging to the outer address. Second, if decoding shows %25 sequences, the text was encoded twice — keep decoding until it stabilizes. And when a decode fails outright, look for a bare % sign in the input; it must always be followed by two hex digits.

Related tools