⌘ K
percent-encode · query · full url · live

Encode text for URLs

Percent-encode strings safely for use in URLs. Choose query-value or full-URL mode. Live, local, no server roundtrip.

URL Encoder
Input
21 B
1 lines
Output
31 B
1 lines
Status
ready
live
Ratio
1.48×
out/in
input · text
output · url-encoded
hello%20world%3F%20%26foo%3Dbar
Quick Start

How to URL-encode: a complete step-by-step guide

URL percent-encoding (RFC 3986) replaces any byte that would confuse a URL parser with a %XX hex triplet. Reserved characters (: / ? # [ ] @ ! $ & ' ( ) * + , ; =) keep their syntactic role unless you escape them; unreserved characters (A-Z a-z 0-9 - _ . ~) are always safe. This encoder picks between encodeURIComponent (escapes everything reserved) and encodeURI (preserves URL skeleton).

  1. 01

    Paste any string destined for a URL

    Drop the raw value you want to embed in a URL — a search query, a redirect target, a mailto subject, a filename, a UTF-8 phrase. Spaces, &, =, ?, #, and any non-ASCII character all need escaping to survive a URL parser.

    If you're starting from a Unicode domain name (e.g. 例え.jp), use the Punycode Converter first — host names use a separate encoding from path/query components.

    RFC 3986reserved charsunreservedUTF-8query value
    input · raw text1 line
    hello world? &foo=bar
    21 B · 21 charsraw · needs escape
  2. 02

    Pick encodeURIComponent or encodeURI

    Component mode (encodeURIComponent) escapes every reserved character — use it for a single query value, path segment, or form input. Full URL mode (encodeURI) preserves the URL skeleton (: / ? # & =) so an entire URL like https://example.com/path?q=value stays parseable.

    Rule of thumb: encoding a piece you'll splice into a template → component. Encoding a whole URL you already assembled → full.

    encodeURIComponentencodeURIRFC 3986 § 2.2skeletonsplice
    mode · selectorcomponent
    encodeURIComponent  vs  encodeURI
    mode setRFC 3986
  3. 03

    Watch the percent-encoded output

    Every byte outside the unreserved set becomes a %XX triplet of UTF-8 bytes — space is %20, ? is %3F, & is %26, = is %3D. Non-ASCII characters expand to multiple triplets (one per UTF-8 byte): é → %C3%A9, 🚀 → %F0%9F%9A%80.

    Note that application/x-www-form-urlencoded form bodies use + for space instead of %20 — that's a separate convention handled by your HTTP client (URLSearchParams), not by this encoder.

    %XX tripletUTF-8%20form-urlencodedlive
    output · percent-encoded%xx
    hello%20world%3F%20%26foo%3Dbar
    31 B · 1 lineRFC 3986 § 2.1
  4. 04

    Copy, download, or reverse it

    Click Copy to send the encoded value to your clipboard, or Download to save as .txt. Drop the result straight into a query string, an href, a redirect URL, or a webhook parameter.

    To go the other way, paste the encoded string into the URL Decoder. For embedding entire structured payloads as a single token, pair this with the Base64 Encoder in URL-safe mode.

    clipboard.txtround-tripURL-safeno network
    export · actions3 actions
    ✓ Copied to clipboard
✓ Saved: url-encoded.txt
✓ 100% client-side
    ready to ship0 outbound
Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Related toolsURL DecoderBase64 EncoderHTML EncoderPunycode ConverterUnicode ConverterSlugify
Use Cases

When to URL-encode

Query strings, redirects, deep links.

Query parameters

Pass values containing &, =, +, or spaces safely. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

OAuth redirects

Embed return_to URLs inside another URL. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Mailto links

Encode subject and body for mailto: URLs. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

API requests

Build clean GET URLs from arbitrary inputs. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Webhooks

Encode signed tokens passed in URL params. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Deep links

Mobile deep links often nest URLs as parameters. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready
FAQ

Frequently asked questions

encodeURIComponent escapes every reserved character — use it for individual query values. encodeURI keeps the URL skeleton (scheme, slashes, ? & = #) intact — use it for entire URLs.
Both modes encode spaces as %20. Form bodies use + instead — that's a different convention handled by your HTTP client.
Yes. UTF-8 bytes are percent-escaped, so emoji and accented characters round-trip cleanly.
Use the URL Decoder tool — it accepts both kinds of percent-encoding.
No. Encoding runs locally in your browser.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!