TuttiTools
%

URL Encoder / Decoder

Encode and decode URL components

Encoding

What is URL Encoding?

URLs can only contain a limited set of characters. Letters, numbers, and a few symbols like hyphens and underscores are always safe. Characters like spaces, accented letters, ampersands, and question marks need to be encoded before being placed in a URL — otherwise they can break the link or be misinterpreted by browsers and servers.

URL encoding (also called percent-encoding) replaces unsafe characters with a % followed by two hexadecimal digits. A space becomes %20, an ampersand becomes %26, and an accented é becomes %C3%A9 in UTF-8.

Smart Auto-Detection

This tool automatically detects whether you’re encoding a complete URL or an individual value and applies the correct behavior:

This distinction matters because encoding a full URL like a component value would destroy the URL structure, turning https:// into https%3A%2F%2F.

Available Options

Encoding

Controls how non-ASCII bytes are represented:

Multiline

When enabled, each line is encoded or decoded independently. Useful for processing a list of URLs or values in bulk.

How to Use This Tool

  1. Select Encode or Decode mode.
  2. Paste your URL or value in the input area.
  3. The result appears immediately — no button to click.
  4. Use the copy button to grab the output.

Common Use Cases

Encoding Reference Table

The characters you’ll meet most often, and what they become when percent-encoded:

CharacterEncodedNotes
space%20 (or + in forms)the single most common encoding
!%21often left unencoded in practice
#%23starts a URL fragment — must be encoded inside values
$%24
&%26separates query parameters — must be encoded inside values
'%27
( )%28 %29
+%2Bdecoded as a space by form handlers if left raw
,%2C
/%2Fpath separator — must be encoded inside values
:%3A
=%3Dseparates key from value — must be encoded inside values
?%3Fstarts the query string
@%40
é%C3%A9two bytes in UTF-8
ç%C3%A7two bytes in UTF-8
😀%F0%9F%98%80four bytes in UTF-8

The characters that never need encoding (the “unreserved set” from RFC 3986) are letters, digits, and -, _, ., ~.

Common Pitfall: Double Encoding

If you see %2520 in a URL, the value was encoded twice — %20 (a space) had its % re-encoded to %25. This usually happens when one system encodes a value and a second system encodes it again. To fix it, decode the value repeatedly until it stops changing, find where the extra encoding step happens, and remove it. This tool’s decoder makes it easy to peel back one layer at a time.

Frequently Asked Questions

Why does this tool sometimes keep ? and & unencoded?

When the input is recognized as a complete URL, structural characters like ?, &, =, :, and / are intentionally preserved — encoding them would break the URL. For individual values (a search term, a parameter value), those characters are encoded because they would otherwise interfere with the URL structure.

Is my data private?

Yes. All encoding and decoding runs locally in your browser. Nothing is sent to a server.

What's the difference between %20 and + for spaces?

Both represent a space, but in different contexts. %20 is the standard percent-encoding defined by RFC 3986 and works everywhere. + is a form-encoding convention (application/x-www-form-urlencoded) valid only in query strings. Select Form encoding if you need + instead of %20.

What does Latin-1 encoding do?

Latin-1 (ISO 8859-1) encodes each character as a single byte. It’s a legacy encoding used by older systems. Characters outside the Latin-1 range (such as Chinese, Arabic, or emoji) cannot be represented and will produce an error. Use UTF-8 for modern applications.

Why does my decoded URL still contain % signs?

Either the URL was encoded more than once (see the double-encoding section above — decode it again), or it contains a literal % that isn’t part of a valid escape sequence. A % not followed by two hex digits is left untouched rather than causing an error.

Do I need to encode the domain name part of a URL?

No — percent-encoding applies to paths, query strings, and fragments. International domain names (like café.com) use a different mechanism called Punycode (xn--caf-dma.com), which browsers handle automatically.

Related Tools