What is URL (percent) encoding?
URL encoding, also called percent-encoding, replaces characters that have special meaning in a URL — or that are simply not allowed in one — with a percent sign followed by their hexadecimal byte values. A space becomes %20, an ampersand becomes %26, and non-ASCII characters are encoded as their UTF-8 byte sequences. This lets you place arbitrary text into a query string, path segment, or fragment without breaking how the URL is parsed.
This tool encodes text into that safe form and decodes percent-encoded URLs back into readable text, using the browser's own standard functions so the results match exactly what your application code will produce. That consistency matters when you are comparing a value your code generated against one captured from a browser address bar or a server log.
Reserved versus unreserved characters
URLs divide characters into two groups. Unreserved characters — letters, digits, and a handful of symbols like hyphen, period, underscore, and tilde — are always safe and never need encoding. Reserved characters such as :, /, ?, #, [, ], @, &, =, +, and the space have structural meaning: they separate the scheme, host, path, query, and fragment of a URL.
The distinction matters because you should encode a value going into a component, not the separators that define the URL's structure. Encoding a whole URL escapes the :// and ? that the URL needs to function, while encoding only each parameter value keeps the link both valid and correct. Modern helpers such as encodeURIComponent are built around exactly this idea, escaping everything that is not an unreserved character so a single value is always safe to drop into a URL.
Common pitfalls: double-encoding and debugging
A frequent bug is double-encoding: encoding a value that was already encoded, so %20 becomes %2520. This happens when a string passes through two layers that both encode it, and it produces links that look almost right but resolve to the wrong target. Decoding once and inspecting the result is the quickest way to diagnose it.
Decoding is equally valuable for reading opaque tracking, OAuth, and redirect URLs, where campaign values and destination addresses are encoded and otherwise impossible to read at a glance. Everything runs locally, so URLs containing session tokens or internal hostnames never leave your device. Keeping a decoder handy turns an otherwise opaque, error-prone part of web development into something you can verify at a glance. Over time that habit prevents a whole class of subtle bugs caused by mismatched or double-applied encoding.