Free URL Encoder & Decoder Online

A URL travels as a stream of US-ASCII characters, a rule fixed by RFC 3986, the 2005 standard that superseded RFC 2396 from 1998 and the original RFC 1738 from 1994. Only a small alphabet may appear literally: the 26 letters A to Z, the 26 letters a to z, the 10 digits 0 to 9, and the 4 marks hyphen, period, underscore, and tilde. RFC 3986 names these 66 symbols the unreserved set, and they pass through untouched. Everything else is either a reserved character with a structural job or a byte with no business appearing raw, and both get rewritten by percent-encoding: a % sign followed by 2 hexadecimal digits spelling the byte value from 0 to 255. A space at decimal 32 turns into %20, an ampersand at 38 into %26, an equals sign at 61 into %3D, a slash at 47 into %2F, a question mark at 63 into %3F, a hash at 35 into %23, a plus at 43 into %2B, and a colon at 58 into %3A. A character above code point 127 is first split into UTF-8 bytes, then each byte is escaped in turn: the em dash, U+2014, expands to the 3-triplet run %E2%80%94, the euro sign U+20AC to %E2%82%AC, the letter é at U+00E9 to the 2-byte %C3%A9, and the emoji U+1F600 to a 4-byte %F0%9F%98%80. Decoding walks the reverse map, reading each %XX back into 1 byte and reassembling the multi-byte runs into characters.

The mistake that breaks real query strings is treating every symbol as safe. The 18 reserved characters in RFC 3986, split into gen-delims and sub-delims, do structural work. The gen-delims most seen in a query, the ampersand %26 and equals sign %3D, separate 1 parameter from the next and split a key from its value; the question mark %3F opens the query, the hash %23 marks the fragment, the slash %2F divides path segments, and the colon %3Aends the scheme after the 5 letters of https. When a user types a value holding an ampersand, say the company AT&T, and you paste it into a query string unescaped, the parser reads that ampersand as a separator and shatters your 1 value into 2 broken parameters. Escaping it to %26 defuses the character: the receiving server turns %26 back into a literal ampersand inside the value and never confuses it for syntax. That is the whole job of percent-encoding, letting data carry bytes that would otherwise be parsed as grammar.

JavaScript ships 2 encoders, and picking the wrong 1 is the single most common bug this tool exists to fix. encodeURIComponent, the Component scope above, targets 1 piece of a URL: a single query value, 1 path segment, a fragment. It escapes all 18 reserved characters, the slash %2F, question mark %3F, ampersand %26, equals sign %3D, hash %23, and colon %3A among them, because inside a lone value none of those should keep structural meaning; it spares only 11 extra marks beyond the unreserved 66, among them the exclamation point at 33, the 2 parentheses at 40 and 41, the asterisk at 42, and the apostrophe at 39. encodeURI, the Full URL scope, assumes an entire assembled address and preserves the structural set colon %3A, slash %2F, question mark %3F, hash %23, ampersand %26, and equals %3D so the URL stays valid. The break is concrete: feed a complete https:// address through encodeURIComponent and its slashes mutate into %2F, collapsing the string into 1 unusable blob; feed a raw value through encodeURI and any ampersand or equals hiding inside it survives to corrupt the surrounding query. Reach for Component scope when assembling 1 parameter, Full scope when you already hold a finished URL needing only its spaces and non-ASCII cleaned. Neither routine touches the 66 unreserved symbols, so hyphens at %2D, periods at %2E, underscores at %5F, and tildes at %7E read identically on both sides.