URL Encoder & Decoder

Component mode uses encodeURIComponent / decodeURIComponent, which escapes every reserved character including the slash, colon, question mark, ampersand, and hash. Use it when you are encoding a single value that will live inside a URL — a query-string value, a path segment, or a fragment. Whole-URL mode uses encodeURI / decodeURI, which deliberately leaves the structural characters (: / ? # [ ] @ & =) intact so the overall URL stays well-formed. Picking the wrong one is the most common URL bug we see: encode a full URL with encodeURIComponent and the slashes turn into %2F, breaking the link.

No. Encoding and decoding run entirely in your browser using the native encodeURIComponent, decodeURIComponent, encodeURI, and decodeURI functions. Nothing is uploaded, logged, or stored, and you can confirm that by checking your browser's network tab while you type — there are zero requests. That makes it safe for URLs that contain access tokens, signed query parameters, or internal hostnames you would not want to paste into a remote service.

The decode functions throw a URIError when they hit a malformed percent-escape — for example a lone % sign, or a multi-byte UTF-8 sequence such as %E0 that is missing its trailing bytes. When that happens this tool surfaces the error instead of returning a half-mangled string. The fix is almost always to re-encode the value correctly at the source, or to confirm you are decoding something that was actually percent-encoded in the first place.

These functions encode a space as %20, which is correct for path segments and modern query strings. The legacy application/x-www-form-urlencoded format used by HTML form posts encodes a space as a plus sign (+) instead, and treats a literal plus as %2B. If you are round-tripping classic form data, be aware that decodeURIComponent will not turn a + back into a space — that conversion belongs to form decoding, not URI decoding.

Correct encoding never changes meaning — it only makes the URL safe to transmit by escaping characters that would otherwise be ambiguous or illegal. A correctly encoded URL decodes back to exactly the original. The danger is double-encoding: if you run an already-encoded string through the encoder again, %20 becomes %2520 and the link silently breaks. When in doubt, decode first, confirm you see the human-readable form, then encode once.