Z

URL Encode / Decode

Percent-encode text for safe use in URLs, or decode encoded URLs back to text.

Runs in your browser — files never leave your device

Input
Output

How it works

Switch between Encode and Decode and the result updates as you type. Encode applies percent-encoding with encodeURIComponent semantics: every character except the letters A–Z and a–z, the digits 0–9 and the marks -_.!~*'() is converted to its UTF-8 bytes, and each byte is written as % followed by two hex digits. Decode reverses the process.

Because reserved URL delimiters — : / ? # & = — are among the characters that get encoded, this is component encoding: it is meant for one piece of a URL at a time, such as a query-string value or a path segment, not for complete addresses. Encoding a full URL breaks it — https://example.com/a b?x=1 becomes https%3A%2F%2Fexample.com%2Fa%20b%3Fx%3D1. Encode the parts, then assemble the URL.

A concrete example: 50% off & free shipping encodes to 50%25%20off%20%26%20free%20shipping. The percent sign itself becomes %25 so it cannot be mistaken for the start of an escape, spaces become %20, and the ampersand becomes %26 so it will not terminate the query parameter early. Non-ASCII text works the same way at the byte level: ₹100 becomes %E2%82%B9100 — the rupee sign’s three UTF-8 bytes.

Typical uses: building query strings by hand or in shell scripts and curl commands, passing one URL as a parameter inside another (redirect and callback parameters), encoding search terms, and making webhook or API payload values transport-safe. Decode is the debugging direction — paste a dense query string from your logs and read what it actually says.

Two gotchas. This tool always encodes a space as %20; the + convention belongs only to form-encoded data, and the decoder leaves + as a literal plus rather than turning it into a space. And encoding twice corrupts the string — a%20b re-encodes to a%2520b — so encode exactly once. If Decode returns nothing, the input contains a malformed escape such as a stray percent sign without two hex digits after it.

Frequently asked questions

Is this encodeURIComponent or encodeURI?
It uses encodeURIComponent semantics: reserved delimiters such as the colon, slash, question mark, hash, ampersand and equals sign are encoded too. That makes it right for individual pieces — query values, path segments, form fields — and wrong for whole URLs, which come out as https%3A%2F%2F… and stop working. encodeURI, which this tool does not use, would leave those delimiters intact.
Which characters are never encoded?
The unreserved set: letters A–Z and a–z, digits 0–9, and the marks - _ . ! ~ * ' ( ). Everything else, including spaces and all non-ASCII characters, is converted to percent-encoded UTF-8 bytes.
Should a space be %20 or +?
This tool always produces %20, which is valid everywhere in a URL. The + shorthand for a space is specific to form-encoded data (application/x-www-form-urlencoded), and the decoder here leaves + as a literal plus sign — decoding a+b gives a+b. If your string came from a form post that uses +, replace each + with %20 before decoding.
What is double encoding?
Encoding text that is already encoded: a%20b becomes a%2520b, because the % itself is escaped to %25. It usually happens when two layers of a system both encode. If you see %25 sequences in logs, run Decode repeatedly until the string stops changing to count the layers — then fix the code so encoding happens exactly once.
How are emoji and non-Latin text handled?
Characters are converted to UTF-8 first, then each byte is percent-encoded. The rupee sign ₹ becomes the three bytes %E2%82%B9, and the thumbs-up emoji becomes the four bytes %F0%9F%91%8D. Decoding reassembles the bytes into the original characters.
Why does Decode return empty output?
The input contains a malformed escape — most often a % that is not followed by two hexadecimal digits, or percent-encoded bytes that do not form valid UTF-8. Rather than returning a partial or corrupted string, the tool outputs nothing; fix or remove the broken sequence and try again.
Is my text uploaded?
No. Encoding and decoding run entirely in your browser as you type — nothing is sent to a server, and the same logic powers the ZoolTools mobile app via shared test vectors.

Related tools