URL Encoder Decoder Online
Encode and decode URLs, percent-encode query parameters under RFC 3986, and edit query strings with live parameter tables.
About URL Encoder Decoder Online
Uniform Resource Identifiers (URIs) require strict adherence to ASCII characters. Characters like spaces, question marks, ampersands, slashes, and non-Latin letters must be percent-encoded to prevent breaking URL parsers and query parameters.
This workstation encodes and decodes URL strings according to RFC 3986 and WHATWG standards. It provides three primary operations: component encoding for parameter values, full URL encoding preserving path delimiters, and resilient decoding with malformed token recovery.
An interactive Query String Parameter Table automatically extracts keys and values from pasted URLs, enabling real-time parameter editing and URL rebuilding directly in the browser.
To sanitize URL payloads, convert binary data using the Base64 encoder and decoder or escape HTML markup via the HTML entity encoder.
Step-by-step practical guide
- Paste a full URL, query string, or plain text into the raw input area.
- Select your desired transformation mode: Component, Full URI, or Decode.
- Toggle space formatting: Percent 20 (%20) for RFC 3986 or Plus (+) for form-urlencoded.
- Edit query keys and values directly in the interactive parameter table to rebuild the URL.
- Use Swap to reverse input and output, or Export JSON to save parameter objects.
Engineering specifications and execution details
Encode Component uses encodeURIComponent, encoding all characters except: A-Z a-z 0-9 - _ . ! ~ * ' ( )
Encode Full URI uses encodeURI, preserving structural characters: : / ? # [ ] @ ! $ & ' ( ) * + , ; =
Resilient decoding pipeline prevents fatal URIError exceptions by sanitizing unescaped percent tokens.
Automatic URL decomposition displays protocol, hostname, path segments, and query parameter counts.
Zero remote queries: parsing and percent calculations execute completely inside browser memory.
Data privacy and memory isolation
All URL transformations and query parameter edits execute on client CPU in local memory.
Authentication tokens, OAuth callback URLs, and session secrets are never sent to external servers.
Common production use cases
- Web developers building dynamic API query strings with user-supplied search filters.
- Digital marketers formatting UTM campaign tracking parameters for email and social links.
- Backend engineers sanitizing redirect URLs in OAuth authentication and SSO flows.
- Security researchers testing URL parameter tampering and input sanitization filters.
- Data engineers preparing query strings for automated web scrapers.
Edge cases and operational boundaries
- Plus sign vs %20 for spaces: In query parameters (application/x-www-form-urlencoded), spaces become plus signs (+). In RFC 3986 paths, %20 is standard. Our tool supports both formats.
- Double encoding: Encoding a string that is already percent-encoded turns %20 into %2520. Check input before encoding to avoid double-escaping bugs.
- Reserved characters in paths: Characters like semicolons and commas have specific path meanings in some frameworks and must be encoded when part of a literal name.
- Malformed percent tokens: The decoder catches lone percent signs or invalid hex pairs without crashing, ensuring safe inspection of broken links.
Frequently Asked Questions
What is the difference between encodeURI and encodeURIComponent?
encodeURI is designed for complete web addresses, encoding illegal characters while preserving protocol and path delimiters like colon, slash, question mark, ampersand, and hash. encodeURIComponent is designed for query parameter values, encoding all reserved characters so they cannot break the surrounding URL syntax.
What is percent-encoding (URL encoding) under RFC 3986?
Percent-encoding converts characters that are reserved or not permitted in a URI into a percent symbol (%) followed by two hexadecimal digits representing the byte in ASCII or UTF-8. For example, a space becomes %20 and an exclamation mark becomes %21.
Why are spaces sometimes encoded as plus signs (+) instead of %20?
RFC 3986 specifies %20 as the standard percent-encoding for spaces in URIs. However, the HTML form submission standard (application/x-www-form-urlencoded) historically encoded spaces as plus signs (+). Both conventions are common across web APIs.
Which characters are considered unreserved and never encoded in URLs?
Under RFC 3986 Section 2.3, unreserved characters include uppercase letters (A-Z), lowercase letters (a-z), decimal digits (0-9), hyphen (-), underscore (_), period (.), and tilde (~). These characters never require percent-encoding.
How does this tool handle multi-byte Unicode characters and international text?
Modern URL encoding serializes characters into raw UTF-8 octets before applying percent signs. Multi-byte glyphs such as accented vowels, Cyrillic letters, Asian characters, and emojis are converted into sequences of two to four percent-encoded hex byte pairs without data loss.
Why does decodeURIComponent sometimes throw a malformed URI sequence error?
Standard decodeURIComponent throws a fatal URIError if an isolated percent sign is not followed by two valid hexadecimal characters (such as % alone or %Z1). Our tool uses a resilient decoding pipeline that repairs broken percent tokens without crashing.
How does the Query String Parameter Editor work?
When a query string or complete URL is detected, the engine parses all key-value pairs into an interactive table. Editing any parameter key, updating a value, adding a new row, or deleting an entry immediately recalculates the query string and reconstructs the full URL.
Can I export parsed URL query parameters as JSON?
Yes. Clicking Export JSON generates a formatted JSON object mapping each query parameter key to its decoded value, allowing API engineers to transfer browser parameters directly into Postman, cURL, or automated testing scripts.
Does this URL encoder send my links or query parameters to any remote server?
No. All URL parsing, component decomposition, percent-encoding, and query parameter editing execute 100 percent inside client-side browser memory. Sensitive API keys and session tokens remain private on your machine.