Status202

URL Decoder & Encoder — Decode URL Online Free

100% Private - Processed Locally
Options

Input URL or String

Drop file to load

Processed locally in browser

0 lines0 chars
Offline· no network access
Output String
0 KB0ms
Try also:Base64 Encode/DecodeJSON Formatter & ValidatorJSON to CSV Converter
What is the URL Encoder & Decoder?


Decode URLs and encode strings instantly — this free URL decoder and encoder converts strings to and from percent-encoded (URL-encoded) format, all locally in your browser without sending your data to any server. URL encoding is a fundamental technique in web development: it converts special characters like spaces, ampersands, equals signs, and non-ASCII characters into a %XX hexadecimal escape format that is safe to include in URLs, query parameters, HTTP headers, and form data.


Developers encounter URL encoding constantly: when constructing API request URLs programmatically, when debugging query parameters in network logs, when formatting redirect URLs, when reading encoded webhook payloads, and when working with OAuth callback URLs that contain encoded redirect URIs. A reliable, instant tool for encoding and decoding these strings saves significant time and prevents the subtle bugs that come from manually encoding special characters or forgetting to encode a value that contains a & or =.


Because URLs frequently contain sensitive information — session tokens, user IDs, internal routing paths, API keys in query strings, and encoded redirect URLs — processing them locally rather than submitting them to an online service is the correct security practice. This tool uses the browser’s native encodeURIComponent() and decodeURIComponent() functions, which run entirely in the browser’s sandboxed JavaScript engine with no network access.


How to Use the URL Encoder & Decoder


    

  1. Select your mode in the options bar above the editor. Choose Encode → %XX to convert a plain string to percent-encoded format, or Decode ← %XX to convert a percent-encoded string back to its original readable form.
    2. 

  2. Paste your string into the left panel. For encoding, paste the raw text you want to make URL-safe — for example, a query parameter value like hello world & more or a redirect URL. For decoding, paste the percent-encoded string from a URL, a server log, or a network request.
    3. 

  3. The output appears instantly in the right panel. No button press is needed — the transformation happens immediately as you type or paste. The encoded string uses %XX notation for all characters outside the unreserved character set (letters, digits, -, _, ., !, ~, *, ', (, )).
    4. 

  4. Copy the output using the Copy button and paste it into your HTTP request, your URL constructor function, your Postman collection, or wherever you need the encoded or decoded value.
    5. 

  5. For nested encoded values: some URLs contain double-encoded strings (a URL that has been encoded twice). Decode once, verify the result, then decode again if needed. Each click of decode removes one layer of percent-encoding.
    6. 



Common Use Cases


Building API request URLs with query parameters: When constructing a URL programmatically that includes user-provided input in a query string, each parameter value must be percent-encoded to prevent special characters from breaking the URL structure. Paste the raw parameter value here, encode it, and use the output as the safe query string value. This is especially important for search queries, redirect URLs, and filter values that may contain spaces, ampersands, or other reserved characters.


Debugging encoded webhook payloads: Webhooks and OAuth callbacks often deliver encoded data in their URL query strings. When a webhook arrives with a URL like ?data=Hello%20World%26More, decoding it here instantly reveals the original value. This is faster than writing a decode call in your debugger or adding a temporary log statement to your webhook handler.


OAuth 2.0 redirect URI handling: OAuth flows pass redirect URIs as query parameters in authorization request URLs. These URIs must be percent-encoded within the outer URL. Developers working with OAuth integrations frequently need to encode or decode these nested URLs to verify the correct redirect target is being passed. Paste the redirect URI here to encode it for inclusion in the authorization URL.


Reading server log entries: Web server access logs record the raw request URLs, which often contain percent-encoded query strings. When analyzing logs to debug a user’s request or trace an issue, paste the encoded URL or query string here to decode it into a human-readable form instantly — without needing to write a log parsing script.


Form data debugging: HTML form submissions using the POST method with application/x-www-form-urlencoded encoding send the form data as a percent-encoded string in the request body. When debugging form submission issues, paste the raw request body here (in decode mode) to see the original field names and values clearly.


How Browser-Only Processing Works for This Tool


This tool uses two native browser JavaScript functions that are part of the ECMAScript standard:


    

  • encodeURIComponent(string) — encodes a string by replacing each special character with one, two, three, or four escape sequences representing the UTF-8 encoding of the character
    • 

  • decodeURIComponent(string) — decodes a percent-encoded string by converting each %XX escape sequence back to the corresponding character
    • 



These are built-in functions available in every browser and JavaScript runtime. They run within the browser’s sandboxed JavaScript execution context with no network access. When you paste text and the output appears, the only computation that happened was a direct call to one of these native functions — no data was sent anywhere.


Verify this by opening DevTools (F12), going to the Network tab, and encoding or decoding a string. You will see zero outbound network requests. The transformation is equivalent to running encodeURIComponent() or decodeURIComponent() directly in your browser console.


Example Input (Encode)


https://example.com/search?q=hello world & test


Example Output (Encode)


https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dhello%20world%20%26%20test


Why use this offline tool?


URLs often contain sensitive query parameters, session tokens, or internal routing structures. This tool ensures your endpoints and parameters are processed locally and are never stored in server logs.


Frequently Asked Questions
What does URL encoding do?▼
URL encoding (also known as percent-encoding) converts special characters in a string into a format that can be safely transmitted over the internet. For example, a space becomes %20, an ampersand becomes %26, and a forward slash becomes %2F. This encoding is required because URLs have a defined set of allowed characters, and characters outside that set must be escaped to avoid being misinterpreted as URL structure rather than data.
Is this secure?▼
Yes, the encoding and decoding processes run entirely within your web browser using JavaScript's native encodeURIComponent() and decodeURIComponent() functions. Your data is not sent to any server — there are no network requests, no logging, and no data storage. URLs often contain sensitive query parameters, session tokens, and internal routing information, so processing them locally is the correct approach.
What is the difference between URL encoding and Base64 encoding?▼
URL encoding (percent-encoding) converts unsafe URL characters to a %XX hexadecimal escape format, preserving the text as largely human-readable. It is used specifically to make strings safe for inclusion in URLs. Base64 encoding converts arbitrary binary data to a fixed set of 64 printable ASCII characters — it is used for data transmission in email, HTTP headers, and JSON payloads where the original data might be binary. For URL query parameters, use URL encoding; for embedding data in headers or JSON, use Base64.
When should I use encodeURIComponent vs encodeURI?▼
encodeURIComponent() encodes everything except letters, digits, and - _ . ! ~ * ' ( ) — it encodes the slash, colon, and all other URL structural characters. Use it for individual query parameter keys and values. encodeURI() preserves the URL's structural characters like :, /, ?, #, and & — use it only when encoding a complete URL where you want to keep the structure intact but encode any invalid characters in the host or path. This tool uses encodeURIComponent() for maximum safety.
Why is %20 used instead of + for spaces in some URLs?▼
Both %20 and + represent a space character, but in different URL contexts. %20 is the RFC 3986 standard percent-encoding for a space and works correctly in any part of a URL. The + notation for spaces is specific to the application/x-www-form-urlencoded format used in HTML form submissions — it is not valid in path segments or general query strings. For universal compatibility, this tool uses %20, which is the safer choice for API requests and manually constructed URLs.