How do I decode a percent-encoded URL?

Paste the percent-encoded URL or string into the input field and click decode. The tool reverses every %XX sequence back to its original character — %20 becomes a space, %26 becomes & , %C3%BC becomes ü , and %F0%9F%98%80 becomes 😀 . It handles multi-byte UTF-8 sequences correctly (like %C3%A9 for é ). The decoded output appears instantly — copy it with the copy button.

URL Encode/Decode Online (Percent Encoding)

Percent-encode or decode text for URLs. Switch between encodeURI and encodeURIComponent, convert Unicode domain names to punycode (xn--), and explore an interactive RFC 3986 reserved-character table — all in your browser.

Result

InputEncodingIDN (punycode)

RFC 3986 reserved-character referenceClick a character to insert it into the input.

What is URL Encoder / Decoder?

URL encoding (percent-encoding) converts characters that are not allowed in URLs into a % followed by two hexadecimal digits. It's essential for safely transmitting data through query parameters, form submissions, and API calls.

Reserved characters — characters like ?, &, =, # have special meaning in URLs and must be encoded when used as data.

Unsafe characters — spaces, <, >, {, }, |, \, ^, and non-ASCII characters must always be encoded.

UTF-8 aware — modern URL encoding uses UTF-8, so emoji and international characters are handled as multi-byte sequences.

Two standards, now switchable — encodeURIComponent (encodes almost everything) vs encodeURI (preserves URL structure); pick the one you need.

IDN (punycode) — converts Unicode domain names (bücher.de) to their ASCII xn-- form and back.

RFC 3986 reference — an interactive table of reserved characters and how each function treats them.

Zero-Server Tool Data Guarantee

All encoding, decoding, punycode conversion, and table lookups happen locally in your browser. Your URLs, query values, and form data never leave your device — no server upload, no logging, no tracking.

How to Use

Pick a Mode

Encode makes a string URL-safe; Decode reverses percent-encoding. The Encoding selector only affects encode output.

Choose encodeURI or encodeURIComponent

encodeURIComponent (default) encodes a query value safely; encodeURI preserves the structure of a full URL.

Paste, Type, or Drop a File

Paste a URL, query value, or percent-encoded string, or drop a text file.

Enable IDN (punycode) for Domains

Turn on 'IDN (punycode)' to convert Unicode domain names to their xn-- ASCII form and back.

Copy

The output updates in real time; use the copy button to grab the result.

Common Use Cases

Query Parameter Encoding

Encode user-provided search terms, filters, or form data before appending them to a URL.

API Request Building

Properly encode values in REST API URLs to handle special characters, spaces, and Unicode.

Form Data Submission

Convert form field values to percent-encoded format for POST requests with application/x-www-form-urlencoded.

International Domain Names

Convert Unicode domains (éxample.com) to their ASCII punycode form for DNS and links.

Debugging Redirects

Decode percent-encoded URLs to understand what data is being passed between services.

Implementation Examples

JavaScriptBrowser (built-in)

// Encode a value for use in a query parameter
const search = encodeURIComponent('hello world & more');
// "hello%20world%20%26%20more"

// Decode it back
const decoded = decodeURIComponent('hello%20world%20%26%20more');
// "hello world & more"

// encodeURI preserves URL structure (leaves :, /, ?, &, =, #)
const uri = encodeURI('https://x.com/a b?q=1');
// "https://x.com/a%20b?q=1"

// Build a full URL with encoded params
const url = `https://api.example.com/search?q=${encodeURIComponent('test & demo')}`;

encodeURI vs encodeURIComponent

Function	Encodes	Use For
encodeURI	Only unsafe chars (preserves :, /, ?, &, =)	Encoding a full URL
encodeURIComponent	All special chars (preserves only A-Z, a-z, 0-9, - _ . ! ~ * ' ( ))	Encoding a query value or path segment

Production Best Practices & Security

Use encodeURIComponent for query values — it encodes everything except unreserved characters, preventing injection and breaking URL structure. Why:If your query value contains '&' or '=', the browser reads them as URL structure, not data; encodeURIComponent turns them into %26 and %3D.

Use encodeURI for full URLs — it preserves the URL structure while encoding unsafe characters. Why:It leaves ':', '/', '?', '&', '=', '#' intact so the overall URL stays valid while fixing problematic characters in paths.

Always decode server-side — never trust URL-encoded input; validate and sanitize after decoding. Why:Attackers can hide XSS or SQL injection behind percent-encoded payloads that bypass simple front-end filters.

Don't double-encode — check if your framework already encodes parameters before you encode them again. Why:Double-encoding turns %20 into %2520, which won't decode back to a space on the receiving end.

Handle plus signs carefully — in application/x-www-form-urlencoded, + represents a space; decodeURIComponent won't convert it. Why:For form submissions you must map '+' to ' ' yourself or use a form-aware decoder.

Encode non-ASCII characters — international domain names and paths should be percent-encoded for compatibility. Why:Many older systems and protocols only support 7-bit ASCII. Encoding Unicode ensures your URLs work reliably across the entire internet.

Convert IDNs to punycode for DNS — DNS only understands ASCII labels (xn--). Why:'bücher.de' must become 'xn--bcher-kva.de' for a browser to resolve it; keep the Unicode form only for display.

Frequently Asked Questions

URL encoding (also called percent-encoding) replaces characters that are not safe in URLs with a % followed by two hex digits. A space becomes %20, an ampersand becomes %26, and a hash becomes %23.

Without this encoding, browsers and servers would misinterpret your URLs. A space would truncate the address. A & in a query value would look like a parameter separator. International characters like ü or ñ would be garbled.

It is defined by RFC 3986, and JavaScript's encodeURIComponent() handles it automatically.

URLs are restricted to a small set of unreserved ASCII characters (A-Z, a-z, 0-9, -, ., _, ~). Any other character — spaces, punctuation, symbols like & and ?, non-ASCII letters, or binary data — must be percent-encoded.

Without encoding, a URL containing a space would be truncated by the browser, a & in a query value would be interpreted as a parameter separator, and international characters would be garbled.

Encoding is essential for building correct links, form submissions, API requests, and redirect URLs.

They encode different things, and using the wrong one is a common bug. This tool's Encoding selector lets you switch between them, matching the comparison table below.

encodeURI() encodes a full URL and preserves characters that have special meaning in URIs — like /, ?, #, &, and =.

encodeURIComponent() encodes everything except letters, digits, and a few safe symbols (- _ . ! ~ * '). This makes it safe for individual query parameter values or path segments.

For example, encodeURIComponent('hello world & more') returns hello%20world%20%26%20more, while encodeURI would leave the & unencoded and break your query string.

Percent-encoding is UTF-8 aware. When you encode text containing emoji or international letters, each character becomes a multi-byte UTF-8 sequence.

For example, the emoji 😀 (U+1F600) is 4 bytes in UTF-8 and encodes to %F0%9F%98%80; é becomes %C3%A9. Decoding reverses these sequences back to the original characters automatically.

The tool shows a note whenever your input contains non-ASCII text so you know it was handled as UTF-8.

Internationalized Domain Names (IDNs) let sites use non-ASCII characters in their addresses, like bücher.de. But DNS only understands ASCII labels, so browsers convert the Unicode form to punycode (RFC 3492) — bücher.de becomes xn--bcher-kva.de.

Turn on IDN (punycode) to convert a Unicode domain to its ASCII xn-- form for encoding, and a punycode domain back to its Unicode form for decoding.

Emoji and other symbols are generally not valid in hostnames, so they are flagged when you try to punycode-encode them.

Yes. Both encoding and decoding happen locally in your browser. The percent-encoding conversion uses JavaScript's encodeURIComponent() and decodeURIComponent(), and IDN conversion runs the punycode algorithm right on your device — no network requests.

Your URLs, query parameters, and form data never leave your device. It is a stateless local character conversion — no input data is sent, stored, or logged.