URL Encoder / Decoder
Percent-encode or decode URLs and query string values, choosing between the strict encodeURIComponent and the URL-aware encodeURI behaviour.
Encoding and decoding happen entirely in your browser. Nothing is sent anywhere.
What this tool does
This tool percent-encodes text so it's safe to use inside a URL, or decodes percent-encoded text back into readable form. You can choose whether to treat the input as a single value (encodeURIComponent) or a whole URL (encodeURI), since they escape a different set of characters.
Why security professionals use it
Percent encoding appears constantly in web application security work: reading raw web server logs, analysing suspicious query strings for injection attempts, decoding obfuscated phishing links, and understanding how a web application framework will interpret a crafted request.
How it works
Percent encoding replaces characters outside a safe printable set with %XX, where XX is the character's byte value in hexadecimal. Reserved characters that have special meaning in a URL -- such as ?, &, # and / -- are treated differently depending on whether you're encoding a full URL or a single component like a query parameter value, which is why the two JavaScript functions behave differently.
Step by step
- 1Choose Encode or Decode.
- 2Choose whether you're working with a single component or a full URL.
- 3Paste your text into the input box and read the live result.
- 4Use Swap to reverse direction with the result as the new input, or Copy to grab it.
Practical examples
Encoding a search term containing spaces and an ampersand so it can be safely placed into a query string as a single parameter value. Decoding a suspicious URL from a phishing email that uses percent encoding to obscure a redirect target. Recognising a double-encoded payload (%2527 instead of %27) in a web application firewall log during an investigation.
Common mistakes
- Using encodeURI on a single parameter value, which fails to escape characters like & and = that would break the query string.
- Using encodeURIComponent on a whole URL, which incorrectly escapes the protocol and path separators.
- Forgetting that some systems apply encoding more than once, requiring you to decode more than once to see the real value.
- Assuming an encoded URL is automatically safe -- encoding changes representation, not intent.
Security considerations
Percent encoding is a data-representation format, not a security boundary. Applications must still validate and sanitise decoded input on the server side to prevent injection attacks; encoding alone does not make user input safe. When reviewing logs or URLs during an investigation, always decode fully (watching for double encoding) before judging whether a request looks malicious.
Frequently asked questions
What's the difference between encodeURIComponent and encodeURI?
encodeURIComponent escapes almost every reserved character and is meant for encoding a single value such as a query parameter. encodeURI leaves characters that are structurally part of a URL (like :, /, ?, &, #) untouched, because it's meant for encoding a whole URL rather than one piece of it.
What is double encoding and why does it matter?
Double encoding happens when already percent-encoded data is encoded again (e.g. %2520 instead of %20). Attackers sometimes use it to slip malicious input past filters that only decode once, so security teams need to recognise and normalise it during log or WAF analysis.
Why do phishing URLs use percent encoding?
Percent encoding can be used to obscure suspicious characters or entire substrings within a URL, making a malicious link harder to recognise at a glance while still functioning correctly when a browser decodes and follows it.
Is percent encoding a security control?
No -- it's a data-representation format. It matters for security because improperly encoded or decoded input is a common source of injection and request-smuggling vulnerabilities, but the encoding itself doesn't authenticate or authorise anything.
Related tools
HTML Entity Encoder & Decoder
Encode or decode HTML entities to learn XSS output encoding and de-obfuscate payloads.
Base64 Encoder / Decoder
Encode and decode Base64 strings, a format you meet constantly in logs and payloads.
JWT Decoder
Inspect the header, payload, algorithm and claims of a JSON Web Token locally.