URL Encoder and Decoder Guide: Percent Encoding, Spaces and UTF-8

How to encode or decode URL text

Open URL encoder & decoder and paste the entire value you want to transform. Under Encoding style, select URL component (%20 for spaces), Form value (+ for spaces) or Whole URL (preserve separators). Encode and Decode act on the full editor input; merely typing does not convert it.

Read the output before using Copy result or Download. Use result as input lets you apply another operation when the result fits the input limit. Changing input or the encoding style clears the old result. Wrap lines changes visual wrapping only; it does not insert line breaks or alter percent escapes.

• For a single query value or path segment, choose component mode rather than encoding an entire assembled query.
• Use form value mode only when the receiving format expects application/x-www-form-urlencoded value rules.
• For an already assembled address whose separators should remain meaningful, consider whole mode; it is still not a URL parser or validator.

Choose a component, form value or whole URL

Encoding a component prevents reserved punctuation in a value from acting as URL structure. Form value mode uses the form-encoding rules for one value and returns no parameter name. Whole mode preserves separators such as the colon, slash, question mark, ampersand, equals sign and fragment marker in the text.

Choose the style according to the receiving application, not according to which output looks shortest. Encoding a whole query as one value, or leaving separators exposed inside a value, can change the meaning. This tool does not split a pasted query into name/value pairs or decide which portion belongs to the host, path, query or fragment.

RFC 3986: URI syntax, unreserved characters and percent encodingWHATWG URL: Form URL-encoded parsing and serializationECMAScript: encodeURI and decodeURI

What percent encoding does to bytes

A percent escape is a percent sign followed by two hexadecimal digits representing one byte. Unicode characters can require several UTF-8 bytes, so one visible character can need several escapes. The ASCII space is 20 in hexadecimal and appears as %20 in component and whole encoding; form encoding represents that space as +.

These fixed examples show why the style matters. A literal plus and an encoded space are different values. The slash and query punctuation in the third row belong to a component in one case and remain structural characters in whole mode. No address is requested by either action.

RFC 3986: URI syntax, unreserved characters and percent encodingWHATWG Encoding: UTF-8 and text decodingWHATWG URL: Form URL-encoded parsing and serializationECMAScript: encodeURI and decodeURI

Component mode and strict escaping

ToolMellow component encoding uses encodeURIComponent and additionally escapes !, apostrophe, (, ) and *. Its literal ASCII set is letters, digits and -._~. This matches the RFC 3986 unreserved set more closely than unmodified encodeURIComponent, which leaves those five extra marks unchanged.

For example, a value red&blue=1 becomes red%26blue%3D1. That value can be supplied as the value of a parameter without its ampersand becoming another query separator. Component decoding uses decodeURIComponent: percent-encoded reserved characters are decoded, while a literal + stays a plus. It does not parse query pairs or normalize a complete URL.

RFC 3986: URI syntax, unreserved characters and percent encodingECMAScript: encodeURIComponent and decodeURIComponent

Form values: plus, spaces, tilde and asterisk

Form value encoding follows URLSearchParams serialization for a single value. A space becomes +, a literal plus becomes %2B, and a literal asterisk is kept. Tilde becomes %7E. These differences are expected: form encoding has its own allowed set, rather than exactly the component mode set.

Decoding first replaces literal plus signs with spaces, then calls strict decodeURIComponent. Thus a+b%2Bc becomes a b+c: the %2B becomes a plus after the initial replacement and is not converted into a second space. This is a value decoder, not the forgiving URLSearchParams query parser. Malformed escapes and invalid percent-encoded UTF-8 fail instead of being repaired.

WHATWG URL: Form URL-encoded parsing and serializationECMAScript: encodeURIComponent and decodeURIComponent

Whole URL mode preserves separators and reserved escapes

Whole encoding uses encodeURI. It preserves separators in an assembled address while escaping spaces and other applicable text. For example, https://example.com/a b?q=a+b#part becomes https://example.com/a%20b?q=a+b#part. The plus remains a plus at this stage; how an application later parses a query is a separate step.

Whole decoding uses decodeURI, which preserves escapes for its own reserved set ;/?:@&=+$,#. For example, %2F, %26 and %23 remain escaped, while %20 becomes a space. This older set is not every RFC 3986 reserved character: %5B and %5D decode to brackets, and whole encoding percent-escapes literal brackets. Whole mode does not parse a URL, validate a host or scheme, normalize an IPv6 host, perform IDNA domain conversion or fetch the address.

ECMAScript: encodeURI and decodeURIWHATWG URL: URL parsing, hosts and URLSearchParamsRFC 3986: URI syntax, unreserved characters and percent encoding

UTF-8, Unicode and the raw-input distinction

Encoding percent-escapes UTF-8 bytes for characters that need escaping. For café, the final letter requires two UTF-8 bytes represented by %C3%A9; the emoji 😀 uses four bytes. The editor limit counts JavaScript UTF-16 code units, so byte length, code-unit length and visible character count need not agree. This conversion does not normalize Unicode text.

Every encoding style rejects an unpaired Unicode surrogate. Whole URL decoding also checks raw input for well-formed Unicode first. Component and form decoding do not perform that separate raw-string check: unescaped literal code units can pass through, while percent-encoded byte sequences must decode as valid UTF-8. Do not interpret successful decoding as a general validation of every literal character or a safe URL.

ECMAScript: encodeURIComponent and decodeURIComponentECMAScript: encodeURI and decodeURIECMAScript: String isWellFormedWHATWG Encoding: UTF-8 and text decoding

Malformed escapes, invalid UTF-8 and unexpected output

An escape needs exactly two hexadecimal digits after each percent sign, and escaped byte sequences must satisfy the decoder’s UTF-8 rules. A literal percent sign you want to encode becomes %25; a stray percent sign in decoding input is an error. The tool does not silently trim whitespace or repeatedly decode until text looks readable.

Check the style and the full original value before changing characters. Raw spaces or line endings remain input data, so they can change an encoding. If you copied an HTML attribute, quoted JSON string or complete request body, parse that outer format separately. Its delimiters and escape rules do not become percent-encoding rules automatically.

ECMAScript: encodeURIComponent and decodeURIComponentECMAScript: encodeURI and decodeURIRFC 3986: URI syntax, unreserved characters and percent encoding

Why %25 appears and when a second decode is wrong

Encoding an already encoded percent sign produces another layer: component encoding %2F yields %252F. A single component decode of %252F returns %2F; a second returns /. Each step changes one encoding layer. The %25 alone does not prove a bug, because an application may intentionally carry encoded text inside another value.

Identify the layer your application expects rather than repeatedly decoding until punctuation appears. A second component decode can turn data into a structural slash or separator. Whole decoding can intentionally retain such escaped separators, so the component example is not a claim that every mode repeatedly removes every escape. The tool does not know an application’s routing or authorization rules.

RFC 3986: URI syntax, unreserved characters and percent encodingECMAScript: encodeURIComponent and decodeURIComponentECMAScript: encodeURI and decodeURI

Query strings, path segments and safe application use

For a query parameter, keep the parameter name and query structure separate from its value. A URL-building API such as URL and URLSearchParams can help assemble and serialize an actual address. This tool transforms the supplied text only; it does not validate a hostname, shorten a link, follow a redirect or decide which scheme your application should permit.

Percent encoding is reversible representation, not encryption, hashing, HTML escaping or authorization. Encoding a dangerous scheme does not make a link trustworthy, and decoding a value does not make it safe to insert as HTML or executable code. Apply the validation and escaping rules of the destination context and keep real secrets out of shared example URLs.

WHATWG URL: URL parsing, hosts and URLSearchParamsWHATWG URL: Form URL-encoded parsing and serializationRFC 3986: URI syntax, unreserved characters and percent encoding

Input limits, output growth and local text files

The input ceiling is 1,000,000 UTF-16 code units, not one million UTF-8 bytes or displayed graphemes. Escaping can make output longer: one million ASCII spaces produce three million component-mode characters. Copy and Download remain available for output that exceeds the input limit, but Use result as input cannot load that oversized result. Available browser memory remains a practical limit.

Opening a local file uses File.text() to read UTF-8 text. Files at or above 4,000,000 bytes are rejected; loaded text over 1,000,000 UTF-16 units is rejected too. Ordinary text reading removes a leading UTF-8 BOM and replaces malformed UTF-8 sequences, so it is not byte-exact binary encoding or decoding in an arbitrary character set. A file extension does not establish its encoding.

W3C File API: Blob text readingWHATWG Encoding: UTF-8 and text decodingECMAScript: String isWellFormed

Copy, text downloads, clearing and privacy

Download saves the result as UTF-8 text in toolmellow-result.txt, not a request, report or opened webpage. A successful empty conversion still enables Copy result and Download. If clipboard access is unavailable, select the output and copy it manually. For a simple check, encode known text, reuse the result when it fits, then decode using the same style.

Clear resets input, result, errors, search/replacement content and editor history while retaining Encoding style and Wrap lines. Working content remains in page memory rather than an account history. Refreshing or closing the workspace discards that working state; downloaded files remain on your device. Clear does not guarantee forensic erasure from browser or operating-system memory.

The conversion runs in a local browser worker and does not send entered URL text, selected file contents or results to a conversion server. Loading the site still sends ordinary request metadata to hosting and uses Google Analytics for page visits, including cookies and browser/device information. Local conversion does not mean anonymity, zero traffic or zero infrastructure logging; consult the site privacy page.

Embed the URL encoder and decoder with a backlink

Choose the page language and open the integration section below the workspace. Copy or download the supplied HTML snippet into a website area that permits external iframes and scripts. It contains the ToolMellow workspace iframe, the sizing script and a visible backlink to the matching localized ToolMellow tool page. Retain that credit link.

Preview the embed on a narrow screen and confirm clipboard permissions and external-resource support on your platform. The embed has the same three styles, text scope and limits; it is not a server conversion API or a URL-fetching service. The supplied link uses nofollow and noopener, so its presence does not guarantee higher search rankings.

Common questions

Sources and further reading

• RFC 3986: URI syntax, unreserved characters and percent encoding
• ECMAScript: encodeURIComponent and decodeURIComponent
• ECMAScript: encodeURI and decodeURI
• ECMAScript: String isWellFormed
• WHATWG URL: Form URL-encoded parsing and serialization
• WHATWG URL: URL parsing, hosts and URLSearchParams
• WHATWG Encoding: UTF-8 and text decoding
• W3C File API: Blob text reading