URL Encoder and Decoder
Percent-encoding both ways, with the component and full-URL modes kept separate. Nothing leaves your browser.
Component or full URL
Picking the wrong mode is the usual reason an encoded URL stops working, and the difference is simple once seen.
| Mode | Escapes | Use for |
|---|---|---|
| Component | Everything except letters, digits and - . _ ~ ! * ' ( ) | A single value going into a query string or a path segment |
| Full URL | Only unsafe characters; leaves : / ? # [ ] @ & = + $ , alone | A complete address that must stay usable as an address |
Encoding https://example.com/a b?x=1 in component mode gives https%3A%2F%2Fexample.com%2Fa%20b%3Fx%3D1, which is correct if you are putting that whole URL inside another URL as a parameter, and broken if you meant it to remain a link. Full URL mode gives https://example.com/a%20b?x=1, which is still a working address with the space fixed.
The %2520 problem
A doubly encoded value is the most common thing people bring to a decoder. A space becomes %20; if that string is then encoded again, the percent sign itself becomes %25 and you end up with %2520. It almost always means a value was encoded by two different layers that each assumed the other had not done it. Decode repeatedly unwinds as many layers as are present in one pass, stopping when the text stops changing.
Plus signs and spaces
In an HTML form submission a plus means a space; in a URL path it means a literal plus character. That ambiguity is inherited from an old convention and cannot be resolved by looking at the string alone, so it is a switch rather than a guess. Turn Treat + as a space on when the value came from a form body, and leave it off otherwise.
What percent-encoding actually is
A URL may only contain a restricted set of characters. Anything else is written as a percent sign followed by the hexadecimal value of each byte, using UTF-8. A space is byte 0x20, so it becomes %20. An é is two bytes in UTF-8 and becomes %C3%A9. An emoji is four bytes and becomes four escapes.
The characters that never need escaping are the unreserved set: letters, digits, and - . _ ~. Everything else is either reserved, meaning it has structural significance such as separating a query from a path, or unsafe to transmit raw.
| Character | Encoded | Why |
|---|---|---|
| space | %20 | Not permitted in a URL at all |
| & | %26 | Separates query parameters |
| = | %3D | Separates a parameter name from its value |
| ? | %3F | Starts the query string |
| # | %23 | Starts the fragment |
| é | %C3%A9 | Two UTF-8 bytes, escaped individually |
How to use it
Paste and press Decode or Encode. Decoding is first because it is what people come here for most. If a value fails to decode, the message says so rather than returning something subtly wrong: an isolated percent sign that is not followed by two hexadecimal digits is not valid percent-encoding, and guessing at it would corrupt the result.
Questions
What is the difference between component and full URL encoding?
Component encoding escapes everything that is not an unreserved character, including the slash, question mark, ampersand and equals sign. Use it for a single value going into a query string. Full URL encoding leaves those structural characters alone so a complete address stays usable, and only escapes spaces and other unsafe characters.
Why do I see %2520 in a URL?
That is a doubly encoded space. A space became %20, then the percent sign itself was encoded again into %25, giving %2520. It means something encoded a value that was already encoded. Decoding twice recovers the original, and the repeat option here does that in one step.
Why does a plus sign not decode to a space?
Because that convention belongs to HTML form submissions rather than to URLs generally. In a form-encoded body a plus means a space; in a path it means a literal plus. The plus-as-space option applies that rule when you know the value came from a form.
Which characters never need encoding?
The unreserved set: letters, digits, hyphen, full stop, underscore and tilde. Everything else either has structural meaning in a URL or is unsafe to send raw, so it is escaped as a percent sign followed by its byte value in hexadecimal.
Is my URL sent anywhere?
No. The conversion runs inside your browser and this tool has no backend, so nothing you paste is transmitted, logged or stored. URLs frequently carry tokens and session identifiers, which is why that matters here.
Related tools
Browse all Sigma Wire tools - every free tool on the site, grouped by category.