URL Encode/Decode
Encode URLs for query strings or decode percent-encoded URL text.
Written by Anil Gautam · Updated
Should you encode a whole URL or only one part?
Encode runs JavaScript's encodeURIComponent, which leaves ASCII letters, digits, the exclamation mark and - _ . ~ * ' ( ) as they are and escapes everything else. That includes :, /, ?, & and =, the characters that give a URL its structure. The default example, https://oneclickuse.com/?q=free tools, comes out as https%3A%2F%2Foneclickuse.com%2F%3Fq%3Dfree%20tools, which no longer works as a link.
Encode the piece that goes inside the URL. For a search term, encode free tools to get free%20tools, then build https://oneclickuse.com/?q=free%20tools. Encoding a complete address is correct in one case: when a URL travels as a parameter of another URL, such as a redirect or share link, so that its own ? and & are not read as part of the outer address. A value containing # also needs encoding, because a browser treats everything after an unescaped # as a fragment and never sends it to the server: C# lessons becomes C%23%20lessons.
What do %20, %26 and %E2%82%B9 mean?
Each escape is a % sign followed by two hexadecimal digits for one byte. A space becomes %20, & becomes %26 and % itself becomes %25, so Tom & Jerry encodes to Tom%20%26%20Jerry and 50% off to 50%25%20off. Text outside ASCII is first converted to UTF-8 bytes. The rupee sign is three bytes, %E2%82%B9, and the Hindi word नमस्ते, six Unicode characters, becomes 54 characters of escapes.
The exclamation mark, apostrophe, round brackets and asterisk stay unescaped. A few strict systems, such as OAuth 1.0 signatures, require them encoded as well, so replace them by hand where needed: ( is %28 and ) is %29.
Why does decoding fail or leave plus signs?
Decode runs decodeURIComponent, which does not turn + into a space. HTML forms send spaces as +, so free+tools stays free+tools here; replace each + with %20 before decoding form data. Invalid URL encoded input appears when a % is not followed by two hex digits, as in 50% or %zz, or when the bytes are not valid UTF-8, such as caf%E9 from an older Latin-1 system.
Double encoding is the other common fault. Encoding %20 a second time gives %2520, because the % turns into %25. If a link shows %25 followed by two hex digits, it was probably encoded twice, and decoding it twice recovers the text. For campaign links, the UTM Link Builder encodes each parameter value for you, and the QR Code Generator encodes WhatsApp messages on its own.