A web address can only contain a limited set of characters. Letters, digits and a few symbols are fine, but spaces, accented letters, ampersands and many punctuation marks have special meanings or are simply not allowed. To send them safely, they are replaced with a percent sign followed by two hexadecimal digits that represent the character's bytes. This is called percent-encoding or URL encoding, and it is why a link to "my file.pdf" often appears as my%20file.pdf. This tool converts in both directions.

How to use the URL encoder and decoder

1. Paste your text or link into the Input URL box.
2. Press Encode URL to turn unsafe characters into %XX sequences. The result is labelled "Encoded:".
3. Press Decode URL to turn %XX sequences back into the characters they stand for. The result is labelled "Decoded:".
4. Use the Copy button to take the result away.

If the string you want to decode contains a broken sequence, such as a lone percent sign followed by non-hex characters, the tool reports "Invalid URL" instead of returning half-converted text.

Encode a value, not a whole link

This is the most important thing to understand about the tool. It uses the browser's component-level encoding, which is designed for one piece of a URL, such as a query-string value. It escapes the characters that have structural meaning in an address, including : / ? # & and =. If you paste a complete link, those structural characters will be encoded too, and the link will no longer work as a link:

The second row is exactly what you want when that whole address must travel as a parameter inside another URL, for example a redirect target such as ?next=. It is wrong if you wanted a clickable address. In that case, encode only the individual parts: the search phrase, the file name, the email address in a parameter.

How the characters map

Each unsafe character is converted to its UTF-8 bytes, and each byte is written as a percent sign and two hex digits. A space is the single byte 0x20, so it becomes %20. The letter "é" takes two bytes in UTF-8 (0xC3 0xA9), so it becomes %C3%A9. A Bengali letter needs three bytes, giving three groups. Characters that are always safe, namely letters, digits and the symbols - _ . ! ~ * ' ( ), are left untouched. Note that a space becomes %20 here, not the plus sign that some HTML form submissions use; the plus form is specific to form-encoded bodies and query strings and is not produced by this tool.

Common reasons you need this

• Building links by hand. You are writing a share link, a mailto link with a subject line, or a search URL and need the text to survive intact.
• Debugging analytics and tracking parameters. Campaign names with spaces or ampersands can silently split a parameter in two. Encoding the value avoids that.
• Reading logs. Server logs and error reports show encoded paths. Decode them to see which file or search phrase was actually requested.
• API testing. A query value containing a slash, a plus sign or a hash must be encoded or the server will read it as part of the address structure.
• Working with non-English text. Links to pages with Bengali or Arabic file names appear as long percent strings. Decoding turns them back into something readable.

Pitfalls and how to avoid them

• Decoding a value twice is also a problem if the original text legitimately contained a percent sign, such as "50% off". Decode only as many times as it was encoded.
• Decode results can contain characters like & or = that look like structure. Never paste a decoded value back into a live URL without encoding it again.
• Encoding is not security. It makes text safe for transport, but it neither hides nor sanitizes it. Do not rely on it to prevent injection attacks; validate input on the server.

Where the work happens

Encoding and decoding use the standard functions built into your browser, run on this page, so the text you enter is not sent to us to be processed.

Frequently asked questions