URL Encoder
/ Decoder — Free
Online Tool

URLs can only contain a limited set of ASCII characters. Spaces, ampersands, forward slashes, Unicode text, and dozens of other characters must be percent-encoded before they can safely appear in a URL. A free URL encoder decoder online converts these characters to their %XX hexadecimal equivalents — and reverses the process when you need to read encoded URLs. WebToolTrix's URL encoder supports 4 encoding standards, real-time output, URL parsing, and double-encoding detection — all 100% client-side.

What Is URL Encoding?

URL encoding (also called percent-encoding) is the process of replacing unsafe characters in a URL with a % sign followed by their hexadecimal ASCII/UTF-8 value. It's defined by RFC 3986 — the standard that governs URI syntax.

For example:

• Space → %20 (or + in form data)
• Ampersand & → %26
• Forward slash / → %2F
• Question mark ? → %3F
• Equals = → %3D

Without URL encoding, browsers and servers can't distinguish between a & that separates query parameters and a literal & that's part of the data.

URL Encoding of Space — %20 vs +

The most common URL encoding question: how is a space encoded? The answer depends on the context:

Rule of thumb: Use %20 for URL paths and API endpoints (RFC 3986). Use + only for HTML form submissions. WebToolTrix lets you choose the right mode for your use case.

URL Encoding Characters — Complete Reference

Here's a complete reference of common URL encoding characters and their percent-encoded equivalents:

URL Encode in JavaScript

JavaScript provides three built-in functions for URL encoding in JS:

For URL decoding in JavaScript, the corresponding functions are decodeURIComponent() and decodeURI(). Never use unescape() — it's deprecated and doesn't handle UTF-8 correctly.

URL Encode in PHP

PHP offers two functions for URL encoding in PHP — and choosing the wrong one is a common source of bugs:

• urlencode($str) — Encodes spaces as +. Follows application/x-www-form-urlencoded format. Use for HTML form data.
• rawurlencode($str) — Encodes spaces as %20. Follows RFC 3986. Use for URL paths and API endpoints.
• urldecode($str) / rawurldecode($str) — The corresponding decoders.

Common mistake: Using urlencode() for path segments. Since + is a valid literal character in URL paths, this causes bugs. Always use rawurlencode() for paths.

URL Encode in Python

Python's urllib.parse module provides comprehensive URL encoding in Python:

• urllib.parse.quote(string, safe='/') — RFC 3986 encoding. The safe parameter specifies characters to not encode (default: /).
• urllib.parse.quote_plus(string) — Form encoding with + for spaces.
• urllib.parse.unquote(string) — Decode percent-encoded strings.
• urllib.parse.urlencode(dict) — Encode a dictionary of query parameters into a query string.

URL Encoder Java

Java's URL encoder class is java.net.URLEncoder:

• URLEncoder.encode(str, "UTF-8") — Encodes spaces as + (form encoding). Always specify "UTF-8" — the deprecated single-argument version uses the platform's default charset, which causes bugs.
• URLDecoder.decode(str, "UTF-8") — The corresponding Java URL decoder.

Important: Java's URLEncoder follows the application/x-www-form-urlencoded format, not RFC 3986. For RFC 3986 compliance, replace + with %20 after encoding, or use a library like Apache Commons' URIBuilder.

URL Encoding for Ampersand (&)

The URL encoding for ampersand is %26. This is critical because & is a reserved character that separates query parameters. If your data contains a literal ampersand, it must be encoded:

• Correct: /search?company=AT%26T (AT&T encoded as data)
• Wrong: /search?company=AT&T (browser sees T as a separate parameter)

In HTML attributes, the ampersand must also be HTML-encoded: &. So a URL in an href might look like: href="/search?a=1&b=2".

URL Encode Forward Slash (/)

The URL encoding for forward slash is %2F. Forward slash is a reserved character used to separate path segments. You only need to encode it when it's part of data, not structure:

• Don't encode: /api/users/123 (slashes are structural path separators)
• Do encode: /search?path=%2Fusr%2Flocal%2Fbin (slashes are part of a data value)

encodeURIComponent() encodes / as %2F. encodeURI() preserves / because it assumes the input is a full URL with structural slashes.

Base64 URL Encoder

A Base64 URL encoder converts binary data or text to a URL-safe Base64 format. Standard Base64 uses +, /, and = — all of which are reserved in URLs. Base64URL replaces them:

• + → - (hyphen)
• / → _ (underscore)
• = → removed (padding stripped)

Base64URL is used in JWTs (JSON Web Tokens), OAuth, and data URIs. WebToolTrix offers a dedicated Base64 Encoder/Decoder for Base64 operations. This page focuses on percent-encoding (%XX format).

Proofpoint URL Decoder

Proofpoint, a corporate email security platform, wraps all links in emails with its own encoded redirect URLs for security scanning. A Proofpoint URL decoder extracts the original URL from Proofpoint's wrapper format. WebToolTrix's URL decoder can decode the percent-encoded portions of Proofpoint URLs — paste the full Proofpoint link, decode it, and extract the original destination URL from the decoded output.

Short URL Decoder

A short URL decoder (or URL expander) reveals the destination of shortened links from services like bit.ly, tinyurl, or t.co. This requires following HTTP redirects — which is a different operation from percent-encoding/decoding. WebToolTrix's URL decoder handles the percent-encoding aspect. For expanding shortened URLs, you'll need a dedicated URL expander tool or simply paste the short URL in your browser's address bar.

HTTP URL Decoder — Reading Raw HTTP

When working with raw HTTP traffic (from tools like curl, Postman, Fiddler, or browser DevTools), query strings and form bodies are percent-encoded. An HTTP URL decoder converts these back to readable text. Paste the encoded query string from your HTTP logs into WebToolTrix's decoder with "Decode + as space" enabled for form-encoded data.

Common Mistakes

• Double-encoding: Encoding a string that's already encoded turns %20 into %2520. WebToolTrix's double-encoding detection prevents this
• Wrong function: Using encodeURI() for query parameters (it won't encode &, =, ?). Always use encodeURIComponent() for parameters
• Encoding the entire URL: Don't encode structural characters like ://, /, ?, # in a full URL. Only encode individual parameter values
• Forgetting UTF-8: Always specify UTF-8 encoding in Java, PHP, and Python. Platform defaults can cause mojibake (garbled characters)
• Confusing URL encoding with security: Percent-encoding is a formatting standard, not a security mechanism. Never use it to "hide" sensitive data

Privacy

WebToolTrix's URL encoder/decoder is 100% client-side — your text, URLs, API keys, and auth tokens are processed entirely in your browser and never sent to any server. Safe for production debugging and sensitive endpoints.