URL Encoder and Decoder

What this URL encoder and decoder does

This tool converts Unicode text → UTF-8 bytes → percent escapes, and reverses that process one layer at a time. It supports four contexts: URL component, full URL, query string, and form-style data. The context matters because the same character can be data in one place and syntax in another.

All processing happens locally in your browser. The tool does not navigate to URLs, fetch remote content, preview pages, or execute decoded output.

URL component vs full URL

A URL component is one piece of data, so reserved characters such as /, ?, &, =, and # are encoded. For example, component input café 😀/test?x=1 becomes caf%C3%A9%20%F0%9F%98%80%2Ftest%3Fx%3D1. In full URL mode, those delimiters remain structural while Unicode in the path, query, or fragment is encoded.

This prevents a common mistake: applying component encoding to an entire URL. If https:// is encoded as data, the colons and slashes become percent escapes and the result is no longer a normal URL string. Full URL mode validates that the input is an absolute URL and keeps the scheme, host, port, path separators, query delimiter, and fragment delimiter in their structural roles.

Query strings

Query string mode treats & and the first = in each parameter as syntax. It encodes names and values separately, preserves parameter order, keeps repeated keys, and distinguishes empty values from keys without explicit values where the text form allows it.

For example, empty= has an explicit empty value, while flag has no explicit value. The tool keeps both forms visible instead of converting them into the same shape. It also does not sort parameters, because ordering can matter for signatures, cache keys, tests, and legacy APIs.

Form-style encoding

application/x-www-form-urlencoded uses a special space rule: space → +, while a literal plus sign becomes %2B. That behavior belongs to form-style data and should not be applied to ordinary URL component decoding.

Reserved and unreserved characters

Unreserved characters are A-Z a-z 0-9 - . _ ~ and usually remain literal. Reserved characters include : / ? # [ ] @ ! $ & ' ( ) * + , ; =. Reserved characters may remain as URL structure or be encoded as data depending on the selected context.

Unicode and UTF-8 percent-encoding

é has UTF-8 bytes C3 A9, so its percent-encoding is %C3%A9. 😀 has UTF-8 bytes F0 9F 98 80, so it becomes %F0%9F%98%80. Percent escapes represent bytes, not Unicode code-point notation.

Invalid percent encoding

Malformed percent text such as %, %2, %GG, or abc%4Z is rejected. After percent syntax is valid, the decoded bytes are checked as strict UTF-8. Byte sequences such as %C3, %ED%A0%80, and %F4%90%80%80 are syntactically valid percent escapes but invalid UTF-8.

Those two checks are reported separately because they point to different problems. A malformed percent escape is a syntax error in the encoded text. Invalid UTF-8 means the percent escapes were well formed, but the byte sequence does not represent valid Unicode text under UTF-8.

Double encoding

Encoding an already encoded percent sign adds another layer: space → %20 → %2520. Decode mode intentionally decodes one layer only. If %2520 is decoded, the result is %20, not a space, and the tool reports that another layer may remain.

URL decoding is not sanitization

Decoded output is plain text. It is not automatically safe for HTML, JavaScript, SQL, shell commands, redirects, navigation, authentication checks, or security decisions. Full URL decode mode warns because decoded reserved characters can change path segmentation or query structure if the output is reused as a URL.

How to use the tool

1. Choose Encode or Decode.
2. Select the URL context that matches your data.
3. For encoding, choose whether percent signs should be encoded or valid existing escapes should be preserved.
4. Choose uppercase or lowercase percent escapes.
5. Leave normalization off unless you intentionally want to change the Unicode sequence before encoding.
6. Review warnings and statistics before copying, reusing, or downloading the result.

Privacy and processing

This tool runs in your browser. Your input is not submitted to UnicodeNow. Output is written as text, and downloads use Blob URLs that are revoked after use.

Common uses

• Encoding query values.
• Decoding copied URLs.
• Debugging API parameters.
• Handling form data.
• Inspecting double encoding.
• Testing Unicode URLs.
• Validating malformed percent escapes.

Example

Input:

Hello, café 😀

URL component:

Hello%2C%20caf%C3%A9%20%F0%9F%98%80

Input:

hello world+café

Form-style:

hello+world%2Bcaf%C3%A9

Frequently asked questions