URL Decode and Encode Online

URL decode converts percent-encoded sequences back into their original readable characters. Every `%XX` pair is translated using its hexadecimal value, so `%20` becomes a space and `%40` becomes @. The process is also called percent decoding.

Encoding is the reverse operation, defined by RFC 3986, the URI standard published in 2005. It replaced the older RFC 2396 and still governs every valid web address today.

The mechanism applies to the whole URI family, not just web addresses. It also covers URNs and the form data format used in HTTP POST requests.

URL encoding is the process of converting characters into a `%XX` format that browsers and servers can transmit reliably. Each unsafe character becomes a percent sign followed by its hexadecimal byte value. Without it, a raw space or & inside a value would break the address structure.

Four groups of characters cannot travel inside a URL directly. ASCII control characters are unprintable, and reserved characters like `?`, `/`, and `&` carry structural meaning. Unsafe characters such as spaces and quotes cause parsing errors, while non-ASCII text falls outside the allowed set. Encoding converts all four groups into safe percent sequences.

The need comes from how servers parse requests. A raw `&` inside a parameter value would be read as the start of a new parameter, silently corrupting your data. Encoding removes that ambiguity, which is why every browser, API client, and form submission relies on it.

The decoder turns any percent-encoded input back into plain text in seconds. Use it to decode URL parameters, full query strings, and complete addresses in a single pass.

The output handles multi-byte UTF-8 sequences correctly. Pairs like `%C3%A9` combine back into a single `é` rather than two broken symbols. Command-line one-liners often get this wrong, which makes a tested browser tool the safer choice.

Encoding converts unsafe characters into percent-encoded form for safe transmission. Select the Encode mode, paste your text, and click Encode URL. The URL encoder replaces every reserved and unsafe character automatically.

Unreserved characters pass through untouched, so the readable parts of your text stay readable. Copy the encoded result straight into your link, API request, or form.

Seeing real inputs and outputs is the fastest way to understand percent encoding. The examples below cover the most common situations developers hit in practice.

The table below lists the characters developers convert most often. Keep it handy when you read raw logs or build query strings manually.

Unreserved characters never need encoding. RFC 3986 defines exactly 66 of them: 52 letters, 10 digits, hyphen, underscore, dot, and tilde.

Reserved characters only need encoding when used outside their structural role. A slash separating path segments stays literal, but a slash inside a parameter value must become `%2F`.

Encode any value before placing it inside a query string, path segment, or form submission. This applies to search terms, redirect targets, email addresses, and any user-generated text. Browsers and servers expect the `application/x-www-form-urlencoded` format for standard form posts.

Decode whenever you need to read data coming back the other way. Server logs, analytics exports, webhook payloads, and referrer strings all arrive percent-encoded. A quick URL decode pass turns them into text you can search and compare.

Marketers and analysts hit the same need with UTM tags and campaign links. Campaign names containing spaces or & must be encoded, or Google Analytics will split them into broken parameters. Running the value through the URL encoder takes seconds and prevents corrupted reports.

API development covers both directions daily. REST endpoints reject or misread requests when parameters contain raw spaces, &, or non-ASCII characters. For binary payloads inside URLs, pair this tool with the Base64 Encoder/Decoder .

JavaScript ships built-in functions for both directions, and choosing the wrong one is a classic bug. Use `decodeURIComponent` to decode parameter values and `encodeURIComponent` to encode them. The `encodeURI` function preserves structural characters like `/`, `?`, and `&`, which makes it right for complete addresses only.

This tool supports both workflows. Use URL Component mode for parameter values and Full URL mode when you need to keep the whole address structure readable.

Other languages ship equivalents with the same split. Python uses `urllib.parse.quote` and `unquote`, PHP uses `rawurlencode` and `rawurldecode`, and Java uses `URLEncoder` and `URLDecoder`.

Phishing campaigns use percent encoding to disguise malicious destinations inside legitimate-looking links. A wall of `%XX` sequences hides the real domain from a quick visual scan. Decoding a link before you click it reveals the true target in seconds.

Attackers also use double encoding to slip past security filters. A filter may block `../` path traversal but miss `%252e%252e%252f`, which resolves to the same sequence in two passes. OWASP documents this double encoding trick as a common filter evasion technique. Decoding suspicious input twice is a standard step in security reviews and penetration testing.

This tool is safe for inspecting hostile strings. Decoding happens as plain text in your browser, so nothing is executed, followed, or requested.

Many online converters send your input to a server for processing. This URL decoder runs entirely client-side, so strings containing session tokens, API keys, or personal data stay on your machine. That privacy guarantee matters when you debug production traffic.

The tool is free, requires no signup, and places no limits on conversions or input length. Decode and encode live in the same interface, so switching direction takes one click. It works the same on desktop and mobile browsers.

Toolkit Wizard bundles it with related utilities for everyday development work. Inspect tokens with the JWT Decoder & Encoder or escape markup with the HTML Escape / Unescape tool.