Encode text so it is safe in a URL, or decode a string full of %20 and %3D back into something readable. Paste a whole URL and its query parameters are laid out in a table.
Runs entirely in your browser — nothing you enter here is sent to a server.
A URL may contain only a limited set of ASCII characters, and several of those have a job: ? starts the query string, & separates parameters, = separates a name from its value, # starts the fragment, / divides the path. If the data itself contains one of them — or a space, or any non-ASCII character — it must be written differently, or the URL will be cut in the wrong place.
Percent-encoding is that different way. Each unsafe byte is replaced by % and two hexadecimal digits: a space becomes %20, & becomes %26, and é — two bytes in UTF-8 — becomes %C3%A9. The receiving server decodes the values after it has split the URL apart, so the reserved characters in your data cannot be mistaken for structure.
For one parameter value or path segment. Encodes everything, including / ? & =. This is encodeURIComponent, and almost always what you want.
Leaves the structural characters alone and fixes only spaces and non-ASCII. Use it on a complete address, never on a value.
+ or %20HTML forms encode a space as + in the query string. Everywhere else — paths, and most APIs — use %20. A literal plus sign must be %2B.
%2520 is a space encoded twice (% → %25). It means some layer encoded a value that was already encoded.
A redirect URL passed as a parameter is the classic case: unless the inner URL is fully encoded, its own ? and & are read as part of the outer one and half the parameters disappear. The same happens with email addresses containing + (decoded as a space), search terms containing &, and signatures or Base64 values containing /, + and =. When in doubt, encode every value as a component, and build query strings with your language's URL library rather than by joining strings.
An encoded space. URLs cannot contain literal spaces, so each one is written as %20 — or as + in the query string of a submitted HTML form.
encodeURI is for a complete URL and leaves characters such as : / ? & = # untouched. encodeURIComponent is for a single value and encodes those too. Use encodeURIComponent for parameter values.
%25 is the encoding of the percent sign itself. Seeing %2520 or %253D means the value was encoded twice; find the extra encoding step and remove it.
No. It is a reversible text transformation that anyone can decode. Never rely on it to hide information — and do not put secrets in URLs at all, since they are stored in logs and browser history.
Upzilla checks your sites, servers and APIs around the clock and alerts you the moment something breaks. 10 monitors free, no card required.