Encode or decode URLs and query parameters
Full URL: leaves URL-structural characters (: / ? # [ ] @ & = + $ , ;) untouched — use for an entire URL.
Hit a problem, or wish a tool existed?
Tell us what went wrong while using this tool, or suggest a new free tool — we aim to build new tool ideas within 2 days.
Contact usChoose encode or decode
Pick the direction you need.
Choose the scope
Component for a single value, or full URL to preserve structure.
Paste your text
Get the result instantly, and copy it with one click.
Convert text to and from percent-encoding — the scheme used to safely represent spaces, special characters, and non-ASCII text inside a URL. Choose Component mode (encodeURIComponent) for a single query parameter or path segment, or Full URL mode (encodeURI) to encode an entire URL while leaving its structural characters (: / ? # @ and others) intact. Swap direction instantly to go from encoded text back to plain text. Follows the same RFC 3986 rules browsers use internally, runs entirely in your browser, and nothing you type is sent anywhere.
Component encoding (encodeURIComponent) escapes everything except unreserved characters — A-Z, a-z, 0-9, and - _ . ~ — plus a handful of others it leaves alone (! * ' ( )) — use it for a single query parameter or path segment. Full URL encoding (encodeURI) additionally leaves reserved, URL-structural characters untouched (: / ? # [ ] @ & = + $ , ;), since encoding those would break the URL itself — use it for an entire URL.
The input isn't valid percent-encoded text — for example it contains a lone % not followed by two hex digits.
It's the percent-encoded form of a space character — %20 is hex 20, the ASCII code for space. You'll see it anywhere a URL needs to represent a literal space.
That's a different, older encoding scheme — application/x-www-form-urlencoded, used by HTML forms in query strings — where a literal + means space. This tool uses standard URI encoding (encodeURI/encodeURIComponent), which always produces %20 for a space, never +.
Non-ASCII characters, emoji included, get converted to UTF-8 bytes first, then each byte is percent-encoded separately. A 4-byte emoji becomes four %XX groups — 12 characters from one character.
Unreserved characters (A-Z, a-z, 0-9, - _ . ~) are always safe and never need encoding. Reserved characters (: / ? # [ ] @ ! $ & ' ( ) * + , ; =) have special meaning in a URL's structure, so they're left alone only in Full URL mode and encoded in Component mode.
Whenever it might contain spaces, symbols, or non-English text — for example a search query, a name, or a redirect target being passed as a query parameter. Encoding it first keeps the URL valid and prevents it from breaking the parameters around it.
Yes — paste the percent-encoded value into Decode mode with the matching scope (Component for a single parameter value, Full URL for a complete URL) to get the original text back.
%40 is the percent-encoded form of the @ symbol — commonly seen when an email address is passed as a query parameter value, since @ has special meaning in a URL's structure and needs escaping outside that context.
%27 is a percent-encoded apostrophe ('). It shows up often in encoded names, contractions, or quoted strings passed through a URL.
%23 is the percent-encoded form of #. Since # marks the start of a URL fragment (like a page anchor), a literal # inside a value has to be encoded as %23 so it isn't mistaken for the start of a fragment.
%5D is a right square bracket ], and %5B is a left square bracket [. Both are reserved characters, encoded when they appear inside a value rather than as part of the URL's own structure.
%7D is a right curly brace }, and its counterpart %7B is a left curly brace {. Neither has a reserved meaning in a URL, but both fall outside the unreserved character set, so encoding a value containing them escapes both.
%0A is a line feed (newline) character — the encoded form of a line break inside a text value passed through a URL, such as a multi-line form field submitted as a query parameter.
There's no decrypting involved — percent-encoding isn't encryption, it's a reversible way to represent special characters safely, with no secret key required. Switch this tool to Decode mode and it converts the percent-encoded text straight back to plain text.
No — they're different schemes for different purposes. Percent-encoding (what this tool does) escapes specific characters so text is safe inside a URL. Base64 re-encodes arbitrary binary data into a larger set of ASCII characters, commonly used for things like embedding images or auth tokens, not specifically for URL safety.
No — HTML encoding (using entities like & or <) escapes characters that would otherwise break HTML markup, like < and &. URL encoding (percent-encoding) escapes characters that would break a URL's structure. They solve different problems and use completely different formats.
Yes — running Encode again on already-encoded text will also encode its % characters, turning something like %20 into %2520. If you're not sure whether text is already encoded, decode it first to check, or compare the input against the expected plain-text value before encoding.
Generate strong, random passwords instantly. Adjustable length and character sets (uppercase, lowercase, numbers, symbols), live strength indicator, one-click copy. All generation happens in your browser using the Web Crypto API — passwords are never sent anywhere.
Convert Unix epoch timestamps to human-readable dates and back. Live current-timestamp ticker, auto-detects seconds vs milliseconds, outputs ISO 8601, UTC, local time, and relative ("2 hours ago") formats. Perfect for debugging logs, APIs, and databases.
Comprehensive token tool to decode, verify, and generate JWT (JSON Web Tokens) and PASETO (Platform-Agnostic SEcurity TOkens) instantly. View header, payload, and signature sections with syntax-highlighted JSON. Generate new tokens with custom payloads. Perfect for developers debugging authentication tokens, API tokens, and bearer tokens. Features instant real-time decoding as you type, support for both JWT and PASETO token formats, token generation with custom algorithms (HS256, HS384, HS512), three-part visualization showing header/version, payload, and signature/footer separately, color-coded JSON syntax highlighting for easy reading, one-click copy to clipboard for each section, and complete client-side processing for maximum security. All token processing happens entirely in your browser - tokens are never transmitted to any server, ensuring complete privacy and security. Supports all standard JWT formats and PASETO v2/v4. Ideal for debugging authentication flows, inspecting API tokens, generating test tokens, understanding token structure, validating token claims, and learning about modern authentication. No installation or registration required.
Format, validate, and beautify JSON data instantly. Minify JSON, fix formatting errors, and validate JSON syntax online. Perfect for developers working with APIs and configuration files.