Percent-encode and decode text using either component or full-URL rules, and split any link into its parts with a readable table of query parameters. Choosing the wrong encoding function is a routine source of broken links and injection bugs.

How to use it

  • Paste text to encode, or a percent-encoded string to decode.
  • Pick component when the value goes inside a query parameter or path segment.
  • Pick full URL when you are encoding an entire address and must preserve its structure.
  • Paste a complete URL into the parser to see protocol, host, port, path, query parameters and fragment separately.

Component encoding versus whole-URL encoding

The two modes correspond to the JavaScript functions encodeURIComponent and encodeURI, and the difference is which characters they consider structural. Component encoding escapes the reserved delimiters, so &, =, ?, /, #, + and space all become percent sequences. That is exactly what you want for a value: if a search term contains an ampersand and you do not escape it, the receiving parser reads it as the start of another parameter, and your value is silently truncated.

Whole-URL encoding leaves those delimiters intact because destroying them would destroy the address. Use it only when handed a complete URL containing characters such as spaces or non-ASCII text. The failure to distinguish these is behind a long tail of bugs, from broken redirect targets to parameter-injection flaws where an attacker smuggles an extra parameter into a URL your code assembled by string concatenation.

Reading percent-encoding

Percent-encoding replaces a byte with % followed by two hexadecimal digits, so a space is %20 and a slash is %2F. Non-ASCII characters are first encoded as UTF-8 and then each byte is escaped, which is why a single accented letter becomes two percent groups and an emoji becomes four. Within the query string specifically, historic form encoding also allows + to represent a space, which is why + must itself be escaped when it is meant literally. Double encoding, where an already-encoded string is encoded again and %20 becomes %2520, is a frequent bug and a known filter-evasion technique. All conversion happens locally in your browser and nothing you paste is transmitted.

Frequently asked questions

Which mode should I use for a query parameter value?

Component. Values must have their delimiters escaped or they will be parsed as structure. Reach for whole-URL mode only when the input is an entire address you need to keep functional.

Why did my plus sign turn into a space?

Because in the query string a bare + is traditionally decoded as a space. If the character is meant literally it must be sent as %2B. Component encoding does this for you.

Does the parser fetch the URL?

No. It only parses the string you supply. Nothing is requested, resolved or logged, so it is safe to inspect a suspicious link here without contacting the host.

Related tools: URL Scanner, Base64 Encoder / Decoder, JSON Formatter.