A query parameter that contains & silently splits into two, a file name with spaces breaks a download link, a redirect URL inside a parameter arrives mangled, or a log shows %25252F and nobody knows what the original was. All of these are percent-encoding problems, and they show up for web developers, API integrators, SEO teams building tracking links and admins reading web server logs.
The URL Encoder / Decoder encodes and decodes text in three modes (Component, Full URL and Form data), reports exactly where invalid input breaks, detects double encoding, and breaks any absolute URL into scheme, host, port, path, query parameters and fragment. It runs entirely in your browser.
What is URL encoding?
In simple terms
A URL may only contain a small set of plain ASCII characters, and some of those (/, ?, &, =, #) have a structural meaning. Anything else, or a structural character that should be taken literally, is written as % plus its byte value in hexadecimal. A space becomes %20, & becomes %26, and ü becomes %C3%BC. Decoding reverses this.
Technical background
The generic URI syntax is defined in RFC 3986. It splits characters into three groups:
| Group | Characters | Rule |
|---|---|---|
| Unreserved | A–Z a–z 0–9 - _ . ~ | Never need encoding |
| Reserved (gen-delims) | : / ? # [ ] @ | Separate the parts of a URI |
| Reserved (sub-delims) | ! $ & ' ( ) * + , ; = | Delimit data inside a part, e.g. & and = in query strings |
| Everything else | spaces, quotes, %, <, >, non-ASCII | Must be percent-encoded |
Non-ASCII text is first converted to bytes with UTF-8 and every byte is written as %XX. A literal % therefore becomes %25, which is why encoding twice turns %20 into %2520.
HTML forms use a related format, application/x-www-form-urlencoded, described in the WHATWG URL Standard. It encodes like a component, but writes spaces as +. When decoding form data, + must become a space again; in a normal URL path, + is just a plus sign.
Why use a URL encoder / decoder?
- Build safe query strings. Values containing
&,=,#or?must be encoded, or the receiving server parses them as structure. - Nest URLs. A
redirect_uri,returnorurlparameter that contains another URL needs component encoding. - Read logs and analytics. Web server logs, proxies and tracking tools store URLs encoded; decoding makes them readable.
- Find double encoding. Frameworks, proxies and CMS plugins sometimes encode an already encoded value.
- Debug character set problems. An "invalid UTF-8" error reveals text that was encoded as Latin-1 or another legacy charset.
Who should use it?
- Web and API developers building or debugging URLs, OAuth redirects and webhooks.
- Marketing and SEO specialists creating UTM links and checking what a tracking URL really contains.
- System administrators and security analysts reading encoded paths in access logs and WAF alerts.
- QA testers preparing test cases with special characters and non-Latin text.
How the URL encoder works
Everything happens in JavaScript in your browser; nothing is sent to the NetTools.tech server.
- Component mode uses
encodeURIComponentand additionally encodes! ' ( ) *, which that function leaves alone but RFC 3986 reserves. The result is safe for any query value or path segment. - Full URL mode uses
encodeURI. It keeps reserved characters such as: / ? # & =so that a complete URL still works, and encodes spaces, quotes and non-ASCII characters. - Form data mode encodes like Component mode, then writes
%20as+. Decoding in this mode turns+back into a space first. - Decoding first checks that every
%is followed by two hexadecimal digits. If not, it reports the position (1-based) and the offending sequence. Then it decodes withdecodeURIComponent(Component and Form data) ordecodeURI(Full URL, which leaves encoded reserved characters such as%2Fin place). If the bytes are not valid UTF-8, it reports the first invalid byte run and its position. - Double-encoding hint. If a decoded result still contains
%xxsequences, the tool says the input was probably encoded twice and offers Decode again. - URL breakdown. When the output (or otherwise the input) is an absolute URL with a scheme and host, it is parsed with the browser's URL parser and shown as Scheme, Host, Port, User, Path, Fragment and a table of decoded query parameters in order, including repeated names.
How to use the NetTools.tech URL Encoder / Decoder
- Open the URL Encoder / Decoder.
- Paste text, a parameter value or a URL into Input.
- Choose the Mode: Component for a single value or path segment, Full URL for a whole URL, Form data for HTML-form style query strings or POST bodies. The hint under the mode buttons explains the selected one.
- Press Encode or Decode. After the first run, the output updates automatically while you type or switch modes.
- Copy the result with Copy, or press Use output as input to chain operations, for example decoding twice.
- If the input or output is an absolute URL, check the URL breakdown panel below.
- The Try chips load examples: a query value with
&,/and accented letters, a full URL with spaces, an encoded URL and a double-encoded string.
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
| Output | The encoded or decoded text | The label shows the action and mode, e.g. "encoded, component mode" |
| "Invalid percent-encoding at position N" | A % is not followed by two hex digits | A literal % must be written %25; truncated values often end in %2 |
| "Invalid UTF-8 byte sequence … at position N" | The bytes are not valid UTF-8 | Text encoded as Latin-1 (%E9 for é) or cut in the middle of a multi-byte character |
| Double-encoding hint | Decoded output still contains %xx | Decode again; then fix the code path that encodes twice |
| Breakdown: Scheme, Host, Port | Parts of the authority | Unexpected ports or hosts in redirect parameters |
| Breakdown: User | Username in the URL, if present | Credentials in URLs are a security smell |
| Breakdown: Path, Fragment | Decoded path and #fragment | Encoded slashes or spaces in file names |
| Query parameters table | Each name/value pair, decoded, in order | Repeated names, empty values, nested URLs that need another decode |
Example: a return URL inside a query parameter
You want to link to https://example.com/login with a next parameter pointing to https://example.com/search?q=network tools&page=2.
Encode the inner URL in Component mode:
Input: https://example.com/search?q=network tools&page=2
Output: https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dnetwork%20tools%26page%3D2The final link is:
https://example.com/login?next=https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dnetwork%20tools%26page%3D2Paste that link into the input and press Decode in Component mode: the URL breakdown now lists one query parameter, next, whose value is the complete inner URL. Had you used Full URL mode for the inner URL, &page=2 would have stayed unencoded and the login page would have received two parameters, next and page.
Common use cases
- Encoding values for API calls or
curlcommands by hand. - Decoding URLs from access logs, WAF alerts or phishing reports to see the real destination.
- Building UTM-tagged links whose campaign names contain spaces or non-ASCII text.
- Checking OAuth
redirect_urivalues, which must match exactly, encoding included. - Inspecting a long tracking URL's parameters in the breakdown table.
Troubleshooting
The server receives a value cut off at & or #
The value was not encoded, or was encoded with Full URL mode, which keeps & and #. Encode the value alone in Component mode.
Plus signs turn into spaces
The receiving side decodes form data, where + means space. Encode a literal plus as %2B (Component mode does this).
Decoding leaves %2F or %3F in Full URL mode
That is intended: decodeURI does not decode escaped reserved characters, because decoding them would change the URL's structure. Use Component mode to decode everything.
"Invalid UTF-8 byte sequence"
The source system used another character set. Re-encode the original text as UTF-8 at the source; the tool does not guess legacy encodings.
Encoding error about an unpaired surrogate
The input contains a broken Unicode character (half of an emoji or similar), usually from truncated text. Remove or retype that character.
Common mistakes
- Encoding a whole URL with Component mode. The result is no longer a usable URL; only nested URLs inside a parameter should be encoded that way.
- Encoding twice. Encoding in the application and again in a library or proxy produces
%2520; encode exactly once, at the point where the value is inserted into the URL. - Using
+for spaces in paths.+means a space only in form-encoded query strings and bodies. - Decoding before parsing. Decoding a full URL first and then splitting it on
&breaks values that contained encoded&. Parse first, then decode each value, as the breakdown table does. - Putting secrets in URLs. Tokens in query strings end up in logs, browser history and Referer headers, encoded or not.
Limitations
- Only percent-encoding is covered. Base64, HTML entities and punycode (IDN host names) are different encodings; the breakdown shows host names as the browser's URL parser returns them.
- Decoding assumes UTF-8 and does not convert other character sets.
- The breakdown needs an absolute URL with a scheme and host; relative paths and bare query strings are encoded and decoded but not broken down.
- The browser's URL parser normalizes some details (for example lower-case scheme and host, default ports omitted), so the breakdown can differ slightly from the raw text.
Security & privacy
All processing happens locally in your browser using the built-in encodeURI, encodeURIComponent, decodeURI and decodeURIComponent functions and the URL parser. Nothing you enter is sent to NetTools.tech or anywhere else, and nothing is stored. Even so, avoid pasting URLs that contain live session tokens, password reset links or API keys into any tool you do not control, and treat decoded URLs from phishing reports as untrusted: decoding does not open them.
Related tools
- Redirect Checker – follow a decoded URL hop by hop to its real destination (guide).
- URL Shortener – create a short link for a long, encoded URL (guide).
- HTTP Status – check what a URL returns once it is built (guide).
- Meta Tag Analyzer – check canonical and hreflang URLs of a page (guide).
Summary
Percent-encoding turns characters that would break or change a URL into %XX bytes of their UTF-8 form. Use Component mode for single values and nested URLs, Full URL mode for complete URLs and Form data mode for HTML-form strings with + for spaces. The NetTools.tech URL Encoder / Decoder does all of this in your browser, pinpoints invalid input and shows the parts of any absolute URL.
Frequently asked questions
What is URL encoding?
URL encoding, or percent-encoding, writes characters that are not allowed or have a special meaning in a URL as a % sign followed by two hexadecimal digits. Text is first converted to UTF-8 bytes, so a space becomes %20 and the letter é becomes %C3%A9.
What is the difference between encodeURI and encodeURIComponent?
encodeURI is meant for a complete URL and keeps characters such as : / ? # & = that structure the URL. encodeURIComponent is meant for one piece, such as a query value, and encodes those characters too, so an & inside a value cannot break the query string.
Should a space be %20 or +?
In URL paths and in general percent-encoding a space is %20. The + form belongs to application/x-www-form-urlencoded, the format HTML forms use for query strings and POST bodies, which is what the Form data mode produces.
How do I recognize double encoding?
Double-encoded text contains %25 followed by two hex digits, for example %2520 instead of %20. After one decode the result still contains %xx sequences; the tool points this out and offers a Decode again button.
Why does decoding fail with an invalid UTF-8 error?
The %xx bytes do not form valid UTF-8, often because the text was encoded in another character set such as Latin-1, where é is %E9 instead of %C3%A9. The error message shows the first invalid byte sequence and its position.
Is my input sent to a server?
No. Encoding, decoding and the URL breakdown run in your browser with built-in JavaScript functions. Nothing you type is uploaded.
Which characters are never encoded?
Letters A–Z and a–z, digits 0–9 and the four characters - _ . ~ are unreserved in RFC 3986 and stay as they are in every mode. Everything else is either reserved or must be encoded, depending on the mode.