URL Encoding Reference
| Character | Encoded As | Notes |
|---|---|---|
| Space | %20 | Use %20 in URLs, + in form data |
| & | %26 | Query string separator |
| = | %3D | Key=value separator |
| + | %2B | Encoded when used as literal + |
| / | %2F | Path separator — encode in query values |
| ? | %3F | Query string start character |
| # | %23 | Fragment identifier |
| @ | %40 | Used in email addresses in URLs |
| : | %3A | Protocol separator — encode in query values |
| , | %2C | Sometimes used as value separator |
| ! | %21 | Unreserved in RFC 3986 |
| ( | %28 | Parentheses in query strings |
| ) | %29 | Parentheses in query strings |
| [ | %5B | Array notation in query strings |
| ] | %5D | Array notation in query strings |
Practical Examples
user input & data=hello world
user%20input%20%26%20data%3Dhello%20world
user+input+%26+data%3Dhello+world
How to Use This URL Encoder and Decoder
Select the Encode or Decode tab at the top of the tool, then paste your input into the text area. Results appear instantly as you type — no button to click. In encode mode, choose the encoding method that fits your use case: Component (recommended) uses encodeURIComponent() and is best for encoding individual query parameter values; Full URL uses encodeURI() and preserves the structural characters that give a URL its shape; Form Encoding encodes like Component but replaces spaces with + instead of %20, matching the format browsers use when submitting HTML forms. Use the Swap button to move the output back into the input — helpful for round-trip testing that your encoded string decodes cleanly back to the original. Click Copy Output to send the result to your clipboard in one click.
What Is URL Encoding and Why Is It Required?
URLs can only safely contain a defined set of ASCII characters: letters (A–Z, a–z), digits (0–9), and the symbols - _ . ~. Every other character — including spaces, accented letters, symbols like & and =, and all non-ASCII Unicode — must be replaced with a percent-encoded sequence so it cannot be misread by routers, proxies, or servers as a structural element of the URL. The requirement comes from RFC 3986, the 2005 standard that defines Uniform Resource Identifiers on the web. Without encoding, a space in a URL could be interpreted as the end of the address, and an ampersand inside a query value would be mistaken for a parameter separator. Percent-encoding gives every character a safe, unambiguous representation that travels intact through any HTTP infrastructure.
encodeURI vs encodeURIComponent — Which Should You Use?
encodeURIComponent is the right choice for encoding individual values that will be inserted into a URL — most commonly, the values of query parameters. It encodes everything except the unreserved characters (letters, digits, -, _, ., ~), turning structural characters like /, :, ?, #, &, and = into their percent-encoded equivalents so they cannot interfere with URL parsing. encodeURI is designed for encoding an already-structured URL as a whole. It deliberately preserves the structural characters because removing them would break the URL — so https:// stays intact, slashes between path segments remain, and ? and & in the query string survive unchanged. The practical rule: if you are building a URL by concatenating parameter values, always use encodeURIComponent on each value before joining them. If you have a complete URL you need to sanitize, use encodeURI.
What Does Percent Encoding Mean?
Every percent-encoded sequence starts with a literal % character followed by exactly two hexadecimal digits. Those two digits represent the byte value of the character being encoded in either ASCII (for single-byte characters) or UTF-8 (for multi-byte Unicode). A space has ASCII decimal value 32, which in hexadecimal is 20, so it encodes as %20. An ampersand is ASCII 38 (hex 26), giving %26. For non-ASCII characters, the UTF-8 byte sequence of the character is encoded byte-by-byte. The euro sign € is Unicode code point U+20AC; its UTF-8 encoding is three bytes: 0xE2, 0x82, 0xAC — so it becomes %E2%82%AC in a URL. Decoding simply reverses the process: each %XX sequence is replaced with its corresponding byte, and multi-byte sequences are reassembled into their Unicode character.
Common Characters That Must Be Encoded in URLs
The characters that most frequently require encoding in URLs are: spaces (encoded as %20, or + in form data), ampersands (%26, since they separate query parameters), equals signs (%3D, since they separate keys from values), plus signs (%2B when used as a literal plus rather than a space placeholder), forward slashes (%2F when they appear inside a query value rather than separating path segments), hash signs (%23, which begin a URL fragment), question marks (%3F), and all non-ASCII characters. The characters that are always safe and never need encoding are: the 26 uppercase letters, 26 lowercase letters, 10 digits, and the four unreserved symbols - _ . ~. Everything else should be encoded when in doubt.
URL Encoding in Query Strings and Form Submissions
Query strings are the key-value pairs after the ? in a URL. They use & to separate pairs and = to separate each key from its value. If a value itself contains & or =, those characters must be percent-encoded before the value is added to the query string, or they will be misread as structure rather than content. Always encode each key and value individually with encodeURIComponent before joining them with = and &. HTML forms submitted with method="GET" use the application/x-www-form-urlencoded format: spaces become + and other special characters are percent-encoded. Forms submitted via POST with the default content type use the same encoding for the request body. When constructing URLs in JavaScript, use new URLSearchParams() or manually encode with encodeURIComponent — never concatenate raw user input directly into a URL string.
How to Decode a Percent-Encoded URL
Switch to the Decode tab and paste any percent-encoded URL or string. The tool applies decodeURIComponent(), converting every %XX sequence back to its original character. Plus signs (+) are treated as spaces before decoding, matching form-encoded input. If the URL has been double-encoded — encoded twice, so that %26 became %2526 — you may need to decode twice; use the Swap button to send the decoded output back into the input and decode again. Double-encoding is a common bug that occurs when a parameter value is encoded once by application code and then encoded again by a framework or HTTP library that does not detect the existing encoding. If the decoder shows an error about invalid encoding, look for malformed percent sequences where the two characters after % are not valid hexadecimal digits — for example, %GG or a % sign that appears at the end of the string without two following digits.
Related Articles
Expert guides and educational resources to help you master the math.
URL Encoding Explained: What %20 and Other Percent Codes Actually Mean
URLs can only contain certain ASCII characters — everything else gets replaced with % plus two hex digits. Here's what the most common codes mean and when browsers handle encoding automatically vs when you must.