URL decode and encode

A URL may only contain a small set of ASCII characters, and some of them have a job: / separates path segments, ? starts the query, & and = split parameters, # starts the fragment. Any other character, or one of those used as plain data, is written as a percent sign and two hex digits: the byte value. This is called percent-encoding (RFC 3986, section 2.1).

Characters outside ASCII are first turned into UTF-8 bytes, and each byte is escaped. é is the two bytes C3 A9, so it becomes %C3%A9; the emoji 👋 is four bytes and becomes %F0%9F%91%8B. Decoding does the reverse: it collects the bytes and reads them as UTF-8. The table under the tool shows these bytes for every character that changes.

"URL encode" means slightly different things in different places. The tool shows all four results for the same text, so you can pick the one the receiving side expects.

The common bug is running encodeURI() on a value: a&b=c stays as it is and the server sees an extra parameter. Encode values with encodeURIComponent(), or build the query with URLSearchParams and let it do the escaping. To edit the parameters of a URL you already have, use the URL parser.

JavaScript

encodeURIComponent('café & crème');   // 'caf%C3%A9%20%26%20cr%C3%A8me'
decodeURIComponent('caf%C3%A9%20%26');  // 'café &'

// Form style (+ for space): let URLSearchParams do it
new URLSearchParams({ q: 'red shoes' }).toString(); // 'q=red+shoes'
new URLSearchParams('q=red+shoes').get('q');        // 'red shoes'

// decodeURIComponent does not turn + into a space
decodeURIComponent('red+shoes'.replace(/\+/g, ' '));

Python

from urllib.parse import quote, quote_plus, unquote, unquote_plus

quote('café & crème', safe='')   # 'caf%C3%A9%20%26%20cr%C3%A8me'
quote_plus('red shoes')          # 'red+shoes'
unquote('caf%C3%A9')             # 'café'
unquote_plus('red+shoes')        # 'red shoes'

Note that quote() leaves / alone by default (safe='/'); pass safe='' to encode a single value.

PHP

rawurlencode('café & crème');  // 'caf%C3%A9%20%26%20cr%C3%A8me' (RFC 3986)
urlencode('red shoes');         // 'red+shoes' (form style)
rawurldecode('a%20b');          // 'a b'
urldecode('a+b');               // 'a b'

Go

url.QueryEscape("red shoes & co")   // "red+shoes+%26+co"
url.PathEscape("red shoes")         // "red%20shoes"
s, err := url.QueryUnescape("a%20b+c") // "a b c", err on bad escapes

Java

URLEncoder.encode("red shoes", StandardCharsets.UTF_8); // "red+shoes"
URLDecoder.decode("a%20b+c", StandardCharsets.UTF_8);   // "a b c"

Java's URLEncoder writes form encoding (spaces as +), so it is not the right tool for path segments.

Double encoding. Text that went through an encoder twice has %25 before other escapes: %2520 instead of %20. It usually comes from encoding a value that was already encoded, often a redirect URL passed inside another URL. RFC 3986 says not to encode or decode the same string more than once for this reason. The tool detects it and can decode until nothing is left.

A literal % sign. 50% off is not valid encoded text: a % must start an escape. decodeURIComponent() throws on it; this tool keeps it and shows where it is. Encoded, it is 50%25%20off.

Mojibake like é or �. If é shows up as é, UTF-8 bytes were read as Latin-1 somewhere. If you see �, Latin-1 bytes (like %E9) were read as UTF-8: switch the charset to Latin-1.

Plus signs. A + in a query string usually means a space, but a phone number like +15551234 or a Base64 value sent without encoding loses its plus. Encode a real plus as %2B. Turn "+ means space" off when the input is not form data.

Other text formats have their own escaping: see the string escape tool for JSON, HTML and SQL, and the Base64 decoder for Base64URL values. For API clients and testing tools, browse API tools on DevHunt.