URL Encode & Decode
Percent-encode or decode text three ways — query component (RFC 3986), full URL, or form data with + for space — with UTF-8 made explicit and errors located.
Correctly encoded text for the place it is going (a query value, a whole address, or a form body), the decoded original with its query parameters listed, and the rule each mode follows.
Example: "café au lait" becomes caf%C3%A9%20au%20lait as a component and caf%C3%A9+au+lait as form data; a full URL keeps its :// ? & = while spaces and accents are encoded.
Three encodings,
one alphabet.
Why "URL encoding" is really three different rules, how bytes become %XX, what decoding can and cannot tell you, and the plus sign that trips everyone.
Percent-encoding
A URL may only carry a small ASCII alphabet. Every other byte is written as % followed by two hex digits — and the byte comes from the text's UTF-8 encoding (RFC 3986 §2.5), so é is %C3%A9 and 日 is three groups. Unreserved characters (letters, digits, - _ . ~) are never encoded; reserved delimiters (: / ? # & = + and others) are encoded or kept depending on where the text is going, which is the whole difference between the modes.
The three modes
Component encodes everything reserved — right for one query value or path segment, so that an & inside a value does not split it. This page follows RFC 3986 strictly and therefore also encodes ! ' ( ) *, which JavaScript's encodeURIComponent leaves alone for historical reasons. Full URL keeps the delimiters so the address still parses (the behaviour of encodeURI) and is for addresses that are already structured. Form is application/x-www-form-urlencoded, what an HTML form submits: space becomes +, and only letters, digits and * - . _ stay bare.
Decoding
Decoding reverses %XX into bytes and reads them as UTF-8; a malformed sequence (% not followed by two hex digits) or bytes that are not UTF-8 (a Latin-1 encoding, or binary) are reported with their position instead of producing garbage. A + is a plus sign unless you are in form mode, where it is a space — the most common decoding mistake. When the result is an absolute URL, its query parameters are listed decoded.
What the tool does not settle
Internationalised domain names are not converted to punycode, and whether a server accepts an unencoded character it "should" reject is that server's business. Double encoding (encoding an already-encoded URL) is flagged, not prevented. Nothing is uploaded; the same four anonymous usage counts as the rest of the site apply.
SOURCES
- RFC 3986 §2 — Uniform Resource Identifier: Characters (percent-encoding, reserved and unreserved sets)
- WHATWG URL Standard — application/x-www-form-urlencoded
- ECMA-262 — encodeURIComponent / encodeURI
Last reviewed 18 September 2026. How results are checked: How we verify.