URL Encoder & Decoder Online: Encode Special Characters for URLs
URL Encoder & Decoder Online: Encode Special Characters for URLs
You've built an API endpoint that accepts a search query. A user types something like C++ tutorial & examples and your backend suddenly receives a mangled string — the + signs are gone, the & split your parameter into two, and the whole thing is a mess. Or you've copied a link from a browser's address bar and need to pass it as a query parameter in another URL, but the slashes and colons are going to wreck your routing.
These are URL encoding problems, and they trip up developers at every level, from building search forms to debugging OAuth redirect URIs.
Toolzy's URL Encoder/Decoder converts any string to a safely percent-encoded URL component — and decodes percent-encoded strings back to readable text — instantly, in your browser.
What Is URL Encoding?
URLs are allowed to contain only a limited set of ASCII characters. Letters (A–Z, a–z), digits (0–9), and a handful of special characters (-, _, ., ~) are "unreserved" and can appear in a URL as-is. Everything else — spaces, ampersands, equals signs, slashes, Unicode characters — must be percent-encoded.
Percent-encoding replaces each unsafe byte with a % followed by its two-character hexadecimal code. A space becomes %20, & becomes %26, = becomes %3D, and a Chinese character like 你 becomes its UTF-8 bytes encoded as %E4%BD%A0.
The result is a string that any HTTP client, server, proxy, or router can handle safely without ambiguity about where one parameter ends and another begins.
Why URL Encoding Matters
Query String Parameters
The & and = characters have structural meaning in a query string:
https://example.com/search?q=hello&lang=en
If your query value itself contains & or =, you have to encode them:
https://example.com/search?q=AT%26T%20%26%20Verizon&lang=en
Without encoding, AT&T & Verizon would be parsed as three separate parameters: q=AT, T , and Verizon= — none of which is what you intended.
OAuth and Redirect URIs
OAuth flows pass a redirect_uri as a query parameter. That URI contains its own colons, slashes, and query strings — which must all be encoded before being embedded in the outer URL:
https://auth.example.com/oauth/authorize
?redirect_uri=https%3A%2F%2Fmyapp.com%2Fcallback%3Fstate%3Dabc
&client_id=12345
&response_type=code
Encoding errors here cause "redirect_uri mismatch" errors that are notoriously hard to debug when you can't see the raw decoded value.
Sharing URLs with Special Characters
Copy a URL from your browser's address bar and you'll often see it in decoded, human-readable form. But the moment you paste that URL as a parameter value inside another URL, you need to re-encode it. The same applies to URLs that contain spaces (some browsers display them as spaces; the underlying request uses %20), international characters, or hash fragments.
API Requests and HTTP Clients
When building API requests in curl, Postman, or code, you need to encode parameter values manually if you're constructing the query string yourself. Forgetting to encode a value is one of the most common causes of 400 Bad Request responses from well-typed APIs.
Debugging Redirects and Broken Links
Working backwards from a percent-encoded URL — figuring out what it actually says — is just as important as encoding. When you're reading server logs, debugging a 301 loop, or reverse-engineering a competitor's URL structure, a fast decoder saves significant time.
How to Use Toolzy's URL Encoder/Decoder
Go to toolzy.in/tools/url-encoder-decoder.
To encode a string for use in a URL:
- Paste or type your raw string into the input field. For example:
hello world & more: "stuff" - The percent-encoded output appears immediately:
hello%20world%20%26%20more%3A%20%22stuff%22 - Copy and paste the result wherever you need it.
To decode a percent-encoded URL string:
- Paste the encoded string into the input field. For example:
caf%C3%A9%20au%20lait - The decoded output appears instantly:
café au lait - Copy the readable result.
The tool encodes to encodeURIComponent semantics by default — meaning it encodes everything except unreserved characters (letters, digits, -, _, ., ~). This is the correct behaviour for encoding a single parameter value.
encodeURI vs. encodeURIComponent — What's the Difference?
JavaScript developers often encounter both functions and wonder which to use.
| Function | What it preserves | When to use |
|----------|------------------|-------------|
| encodeURI | :, /, ?, #, &, =, @, !, $, ', (, ), *, +, ,, ; | Encoding a complete URL where structural characters should remain |
| encodeURIComponent | Letters, digits, -, _, ., ~ | Encoding a single parameter value being inserted into a URL |
If you're embedding a full URL as a query parameter value (like an OAuth redirect URI), use encodeURIComponent — you need the slashes and colons encoded. If you're encoding a URL you want to remain navigable, use encodeURI.
Toolzy's tool uses encodeURIComponent semantics, which is almost always what you need when you're encoding a value to embed inside a URL.
Common URL Encoding Problems and Fixes
Spaces encoded as + vs %20. HTML forms traditionally send spaces as + in application/x-www-form-urlencoded payloads. Standard percent-encoding uses %20. Many servers accept both, but APIs that do strict validation may reject + where they expect %20. Always use %20 for query parameter values in API requests.
Double-encoding. This happens when an already-encoded string gets encoded again: %20 becomes %2520 (because % itself gets encoded as %25). If your decoded output looks like it's still percent-encoded, you've double-encoded. Decode it twice, or make sure you're not encoding an already-encoded value.
Forgetting to encode the hash #. The # character signals a fragment identifier to the browser and is never sent to the server. If your parameter value contains a #, it must be encoded as %23, otherwise everything after it is silently dropped from the server's view.
Unicode characters. Non-ASCII characters (accented letters, emoji, CJK scripts) are first converted to their UTF-8 byte sequences, then each byte is percent-encoded. é (U+00E9) is %C3%A9; 😀 is %F0%9F%98%80. The tool handles this automatically.
Frequently Asked Questions
What's the difference between URL encoding and Base64? URL encoding makes text safe for use in URLs by escaping special characters. Base64 converts binary data (or any bytes) to a printable ASCII string for embedding in HTTP headers, JSON fields, or email. They solve different problems. Toolzy has a separate Base64 Encoder/Decoder for Base64 tasks.
Should I encode the entire URL or just the parameter values? Almost always, just the parameter values. Encoding a full URL (including its scheme, host, and path) makes it unnavigable. Encode individual query parameter values before concatenating them into the URL string.
My API returns a 400 error even after encoding — why? Check for double-encoding (encoding an already-encoded value), incorrect content-type headers, or a mismatch between what the server expects and what you're sending. Paste the raw decoded value here first to confirm it looks correct before re-encoding.
Does the tool store my input? No. Everything runs in the browser. No data is sent to any server, and nothing is logged.
Can I encode a full URL path? Yes — paste the full path and the tool will encode it. Keep in mind this will also encode the slashes, so the result is appropriate for embedding as a parameter value, not for direct navigation.
Stop guessing whether your URL characters are safe. Paste them into the URL Encoder/Decoder and get an instant, correct result.