ToolifyHub Team · Updated August 22, 2026 · 4 min read

URL Encoder & Decoder: Percent-Encode URLs, Paths & Query Parameters

Direct Answer & Definition

Percent-encode and decode URLs, paths, and query parameters online. Batch mode, auto-detect, UTM cleaner, tracking parameter scanner, security scoring, and RFC 3986 code snippets. 100% private browser-based tool.

Safely transform URLs and special characters for web compatibility using standard Percent-Encoding. Batch mode, UTM cleaner, tracking scanner, security scoring, and code snippets.

Instant

Private

Free

Last Updated: July 2026|Reviewed by: ToolifyHub.tools Editorial Team|100% Browser-Based Security

100% Private — No server uploads

RFC 3986 Compliant

Instant — No signup

Action Mode & Auto-Detection✓ Plain text URL detected

Batch Mode (Single URL)

Input Character Count

120 Chars

Spaces: 2

Output Character Count

150 Chars

Percent Codes: 0

URL Complexity & Safety

85 / 100

2 Tracker Params

Expansion / Ratio

125%

Encoding size delta

Input URL or Text

2 Marketing Tracker Parameters Found (utm_*, fbclid).

Encoded Output Result

https%3A%2F%2Fexample.com%2Fsearch%3Fcategory%3Dmobile%20phones%26sort%3Dprice%20desc%26utm_source%3Dnewsletter%26utm_campaign%3Dsummer_sale%23results

Complete URL Structure & Query Breakdown

Protocolhttps

Host Domainexample.com

URL Path/search

Fragment Hash#results

Query Parameters (4)

Parameter Key	Decoded Value	Actions
category	mobile phones
sort	price desc
utm_sourceTracker	newsletter
utm_campaignTracker	summer_sale

Developer Code Snippets (6 Languages)

Native URL encoding/decoding implementations for production backend and frontend applications.

// JavaScript URL Encoding
const rawUrl = "https://example.com/search?category=mobile phones&sort=price desc&utm_source=newsletter&utm_campaign=summer_sale#results";
const encodedUrl = encodeURIComponent(rawUrl);
console.log(encodedUrl);

RFC 3986 Standard Specifications

Reserved vs Unreserved Characters

RFC 3986 defines unreserved characters (`A-Z`, `a-z`, `0-9`, `-`, `_`, `.`, `~`) which do not require encoding. Reserved characters (like `:`, `/`, `?`, `#`, `[`, `]`, `@`, `!`, `$`, `&`) serve structural roles and must be percent-encoded when passed inside data values.

Percent-Encoding Mechanism

Characters requiring encoding are converted to their UTF-8 byte representation and formatted as a percent sign `%` followed by two hexadecimal digits (e.g. space → `%20`, slash → `%2F`).

Pro Developer Guidelines

Avoid Double Encoding: Encoding an already encoded URL converts `%20` into `%2520`, which breaks API request routing.
Clean Tracking Parameters: Strip `utm_` tags before encoding URLs to prevent long bloated query strings.

E-E-A-T Advisory Guidelines

Last Reviewed: July 2026 by Web Standards Board

Percent-encoding logic tested against W3C RFC 3986 specifications.

100% Client-Side Privacy: All processing runs locally in browser memory.

Disclaimer: Ensure API route endpoints support UTF-8 encoded parameters.

URI vs URL vs URN — The Identity Hierarchy

RFC 3986: URI is the superset. URL locates, URN names. Don't confuse them.

URI (Identifier)

Generic syntax for identifying any resource. RFC 3986 defines URI = scheme:[//authority]path[?query][#fragment]. Superset of URL and URN.

URL (Locator)

Subset of URI that provides network location (how to access). Includes protocol, host, port. Example: https://example.com/path?query=1.

URN (Name)

Subset of URI that identifies resource by name, not location. Example: urn:isbn:0451450523. Persistent, location-independent.

IDNA & Punycode — Unicode Domains in DNS

IDNA (Internationalized Domain Names)

Allows Unicode in domain names (e.g., 例子.测试). DNS only understands ASCII, so IDNA converts to Punycode.

Punycode Encoding

Prefix: xn--. "例子.测试" → xn--fsq092h.xn--0zwm56d. Browser shows Unicode, DNS resolves ASCII.

Encoding Gotcha

Full URL with Unicode host: encode host separately (Punycode), then percent-encode path/query. Don't encode entire URL as one string.

Query String Normalization — Canonical Form for Caching & Signatures

Sort Parameters

Alphabetical sort by key ensures canonical form. a=1&b=2 → b=2&a=1 (sorted). Critical for caching, signatures, deduplication.

Deduplicate Keys

Repeated keys (a=1&a=2) → keep first or combine (a=1,2). OAuth requires single-value params; form data allows arrays.

Space Consistency

application/x-www-form-urlencoded: space → +. RFC 3986 / query component: space → %20. Pick one and be consistent.

OAuth 2.0 / OpenID Connect — Parameter Encoding Requirements

OAuth 2.0 / OIDC Parameters

redirect_uri, state, scope, code_challenge, code_challenge_method must be percent-encoded per RFC 3986.

Unreserved Chars Only

A-Z a-z 0-9 - . _ ~ are left bare. All others (including / ? # & =) must be encoded in parameter values.

PKCE Code Challenge

code_challenge = Base64URL(SHA256(code_verifier)). No padding. Must use Base64URL (not standard Base64).

Webhook Signature Encoding — HMAC + Base64URL

HMAC Signature Flow

1) Serialize payload (JSON, sorted keys). 2) HMAC-SHA256(payload, secret). 3) Base64URL encode digest. 4) Send in header (e.g., X-Signature).

Base64URL Not Base64

Signature in header must be URL-safe: +→-, /→_, omit = padding. Standard Base64 breaks in HTTP headers.

Timing Attack Prevention

Use constant-time comparison (crypto.timingSafeEqual) when verifying signatures. Never use === or strcmp.

Path vs Query vs Fragment — Different Encoding Rules

Path Component

Reserved: / (segment separator). Encode / only if it's data (e.g., /users/john%2Fdoe). Sub-delims (! $ & ' ( ) * + , ; =) encode as data.

Query Component

Reserved: ? & = # / @. Encode all as data. Space → %20 (RFC 3986) or + (form). Key=value pairs separated by &.

Fragment Component

After #. Not sent to server. Encode reserved chars if used as client-side data (e.g., SPA routing).

Double-Encoding Detection — The Silent URL Killer

%25XX Pattern Detection

Double-encoded: %20 → %2520. Detect by regex /%25[0-9A-Fa-f]{2}/. If found, decode once before processing.

Length Delta Check

decode(str).length vs str.length. If single decode reduces length significantly, likely double-encoded. Safe threshold: >5% reduction.

Reject & Warn

Never silently double-decode. Return error + suggestion: "Input appears double-encoded. Use decode once, then re-encode if needed."

Non-ASCII Percent-Encoding — UTF-8 Byte Sequences

UTF-8 → Percent-Encode

Unicode code point → UTF-8 bytes → each byte as %XX. "é" (U+00E9) → C3 A9 → %C3%A9. "😀" (U+1F600) → F0 9F 98 80 → %F0%9F%98%80.

JS: encodeURIComponent

Automatically handles UTF-8. encodeURIComponent('é') → '%C3%A9'. decodeURIComponent('%C3%A9') → 'é'. Never use escape/unescape (deprecated).

Don't Double-Encode UTF-8

Passing already-encoded %C3%A9 through encodeURIComponent → %25C3%25A9 (wrong). Check for %XX before encoding.

Reserved Character Context — Gen-delims vs Sub-delims

Gen-delims (Generic)

: / ? # [ ] @ — structural delimiters. Encode when appearing as data in path/query. In path: only encode if not serving structural role.

Sub-delims (Sub-component)

! $ & ' ( ) * + , ; = — allowed in path/query data but often encoded for safety. = & critical in query (key=value&a=b).

Context Matters

In path: / is separator → don't encode. In query value: / is data → encode as %2F. Same char, different meaning.

Percent-Decoding Security — Path Traversal & Injection

Path Traversal

Decoded %2E%2E%2F → ../ . If joining with base path without normalization, can escape directory. Always normalize after decode (resolve ./ ../).

Injection Vectors

Decoded %3Cscript%3E → <script>. If reflected in HTML without escaping → XSS. Decoded %27 OR 1=1 → ' OR 1=1. SQL injection if concatenated.

Safe Decode Pipeline

1) Percent-decode. 2) Validate charset (allowlist). 3) Normalize path (resolve ., ..). 4) Context-encode for output (HTML, SQL, JS, Shell).

Why You Actually Need an URL Encoder & Decoder

Percent-encode and decode URLs, paths, and query parameters with our free online URL Encoder & Decoder. Convert special characters in URLs to their percent-encoded format (URL encoding) for safe transmission over the internet, or decode encoded URLs back to readable format. This tool handles query parameters, path segments, and entire URLs with support for both UTF-8 and ASCII encoding standards, making it essential for modern web development, API integration, and digital marketing workflows.

URLs often contain characters that have special meanings in web addresses, such as spaces, ampersands, question marks, hash symbols, and non-ASCII characters. URL encoding replaces these characters with percent-encoded equivalents that web servers and browsers interpret correctly. Our tool goes beyond basic encoding by offering batch processing for multiple URLs, automatic mode detection for mixed inputs, UTM parameter cleaning for marketing campaigns, tracking parameter scanning for privacy audits, and security scoring to identify sensitive data exposure risks. Whether you're a developer debugging API requests, a marketer preparing campaign links, or a QA engineer testing form submissions, this tool provides the precision and flexibility you need.

The built-in code snippet generator exports ready-to-use examples in six programming languages — JavaScript, Python, PHP, Java, C#, and curl — so you can implement percent-encoding directly in your projects without manual translation. All processing happens locally in your browser using client-side JavaScript, meaning your URLs, query parameters, and sensitive data never leave your device. No server uploads, no logs, no tracking. This privacy-first approach is especially valuable when encoding URLs containing authentication tokens, user identifiers, or proprietary campaign parameters that must remain confidential.

Common use cases include: encoding UTM tracking links for email marketing campaigns to prevent client-side breakage; decoding console error logs containing percent-encoded JSON payloads for faster debugging; cleaning tracking parameters from referral URLs before internal processing; validating RFC 3986 compliance for API gateway configurations; and generating language-specific encoding functions for cross-platform development teams. The batch mode handles up to 50 URLs simultaneously, while the auto-detect feature intelligently switches between encode and decode modes based on input patterns, reducing manual切换 errors.

Why Use ToolifyHub.tools?

Our sandbox design enables safe local execution, removing the threat of third-party data collection inherent to typical online tools.

🔒 100% Privacy-First Sandbox

This tool runs entirely inside your browser. No files or inputs are sent to any external server.

❌ No Sign-Up or Accounts

Enjoy instant, anonymous access to all features without sharing email or credentials.

⚡ High-Speed Local Rendering

Optimized client-side rendering ensures near-zero processing wait times.

🎁 Free Forever with Zero Caps

Supported exclusively by simple display advertisements, keeping premium tools accessible to everyone.

🎯 Best For:Developers, students, office managers, and freelancers needing private document/calculation tasks.

💡 When to Use:Choose this when processing sensitive data, private text, spreadsheets, or images that should not sit in cloud databases.

🔑 Key Takeaway:Immediate browser execution guarantees zero storage leak vectors. A fast, clean, desktop alternative.

How to Use the URL Encoder & Decoder on ToolifyHub.tools

Paste Your Link or Text String

Insert the target URL or the query parameters you want to encode or decode into the main input box.

Select the Desired Action Mode

Choose either the encode option to make your text web-safe, or the decode option to translate percent-encoded characters back into readable text.

Choose the Coding Standard

Select whether you want standard encoding or strict URL path encoding, which handles special characters like slashes differently.

Review the Converted Output

Check the live preview field, which displays the translated link instantly as you make changes.

Copy the Result to Your Clipboard

Click the copy button to save the converted link and paste it into your code editor, API client, or marketing campaign tool.

Real-World Scenarios Where This Saves You

🎯

Formatting UTM Tracking Links

A marketing specialist needs to send a promotional link that includes a query string like '?utm_source=spring newsletter&utm_campaign=sales promo'. To prevent email clients from breaking on the spaces, they use the tool to encode the URL, translating the spaces into percent codes.

💼

Debugging API Requests

A software engineer is sending a GET request to an API that accepts search terms as query parameters. The term contains a plus sign and a hash symbol, which they encode using the tool to ensure the API receives the literal characters rather than treating them as system commands.

🚀

Translating Console Error Logs

A customer support agent receives a long, unreadable URL from a client's browser console that contains characters like '%7B%22user%22%3A%22john%22%7D'. They use the tool to decode the URL, revealing that it was passing a simple JSON object containing user details.

Common Mistakes to Avoid

✗

Double-encoding existing URL links: Pasting a web link that already contains percent-encoding and encoding it a second time will turn characters like '%20' into '%2520'. This corrupts the link structure and makes it completely invalid for web browsers.

✗

Encoding complete protocol prefixes: Running encoding on an entire URL, including 'https://', will convert the colon and slashes into percent codes like '%3A%2F%2F'. This makes the link unclickable because browsers no longer recognize the protocol.

✗

Confusing space encoding parameters: Different web standards handle spaces in different ways. Some APIs expect spaces to be encoded as '+', while others require '%20'. Make sure you choose the correct format that matches your server's expectations.

✗

Failing to encode critical hash symbols: If your URL parameters contain a hash symbol (#) that is meant to be part of the data, failing to encode it will cause the browser to treat everything after the hash as a page anchor, dropping the data.

How We Tested This Tool

To guarantee complete accuracy and reliability, our engineering and QA team validates the URL Encoder & Decoder regularly against:

Cross-Browser Compatibility: Verified on standard releases of Google Chrome, Apple Safari, Mozilla Firefox, and Microsoft Edge.
Responsive Viewports: Tested for mobile, tablet, and desktop dimensions to ensure layout responsiveness.
Input Assertions: Subjected to multiple normal, extreme, and empty parameters to prevent script failure and guarantee output correctness.

Local Browser Sandbox vs. Cloud Tools

Metric	ToolifyHub Sandbox	Typical Cloud Services
File Upload Risks	None (0% upload rate)	High (transmits data to remote servers)
Execution Cost	Free forever (No limits)	Subscription-gated or limits applied
Data Retention Policy	Immediate deletion on page close	Retained in cloud buckets or server logs
Processing Latency	Sub-second client execution	Network upload & queuing delays

Authoritative Specifications & Documentation

OWASP Cryptographic Storage Cheat Sheetowasp.org

NIST — Cryptographic Standards and Guidelinesnist.gov

Mozilla Developer Network (MDN) — Web Crypto APImozilla.org

Cloudflare — What is encryption?cloudflare.com

Frequently Asked Questions

Percent-encoding converts non-ASCII characters and special symbols in a URL into a '%' followed by two hex digits. This is necessary because URLs can only safely transmit a limited set of standard characters without breaking.

No, properly encoding your URLs does not harm SEO. Search engine bots are fully designed to read and index percent-encoded URLs, and search engines like Google will automatically display the decoded, readable versions in search results.

Not at all. The encoding and decoding happen entirely in your browser using local JavaScript, meaning your links, keys, and parameters never leave your computer.

If you encode a full URL at once, path slashes and protocol colons are converted to prevent them from being parsed. To keep them intact, only encode the specific parameter values or query strings.

encodeURI keeps structural URL characters (like colons, slashes, and question marks) intact to preserve the URL format, whereas encodeURIComponent encodes all non-alphanumeric characters, making it ideal for query parameters.

Official RFC 3986 Percent-Encoding Cheat Sheet

Quick reference guide for standard URI reserved character percent-encodings:

Space ' '

%20

Hash '#'

%23

Slash '/'

%2F

Colon ':'

%3A

Ampersand '&'

%26

Question '?'

%3F

Related Tools & Workflows

Convert URLs to Base64, Format URL parameters as JSON, Generate QR codes from encoded URLs, Convert HTML links to Markdown