URL Encode

How to use the URL Encode

Type or paste into the Text box, or click Sample. You can also drop a text file on either box, or load one into the URL encoded box with its Open file button.

The URL encoded box updates live as you type. It works both ways — edit the URL encoded side to convert back, or click ⇄ Swap to exchange the sides.

Adjust Mode in the options bar above the editors; the result refreshes immediately. Decode + as space only affects the reverse direction, when you type in the URL encoded box.

Use Copy or Download on either box to take the result, or Clear to start again.

URL encode text and query parameters

URLs may only contain a limited set of ASCII characters. To URL encode a value, every other byte is written as a percent sign followed by two hex digits — %20 for a space, %C3%A9 for “é” — a scheme called percent-encoding and defined in RFC 3986. This tool does it for you, with four modes that match what browsers and server frameworks actually do.

How percent-encoding works

The text is converted to bytes using UTF-8. ASCII characters are one byte; “é” is two bytes (C3 A9); an emoji is four.
Bytes that are “unreserved” — A–Z a–z 0–9 - . _ ~ — are left as they are.
Every other byte becomes % plus its value in hexadecimal, so a space becomes %20 and & becomes %26.

RFC 3986 also defines reserved characters — :/?#[]@ and !$&'()*+,;= — which separate the parts of a URL. Whether they must be encoded depends on where the text goes, which is exactly what the modes below control.

The four modes

Mode	Behaves like	Use it for
Component	`encodeURIComponent()`	A single query value, path segment or fragment. Encodes every reserved character except `!'()*`.
Full URL	`encodeURI()`	A complete URL that already has its structure. Keeps reserved characters such as `:/?#&=` and encodes spaces, non-ASCII text, `%` and unsafe characters such as `"<>{}\|\^`.
Form data	HTML form submission	`application/x-www-form-urlencoded` bodies and query strings built by forms, where a space is `+`.
RFC 3986 strict	`encodeURIComponent()` + `!'()*`	OAuth 1.0 signatures, AWS Signature V4 and other specs that require the strict unreserved set.

Example

The same input encoded in each mode:

https://example.com/a b?q=café & crème&x=it's(1)*

Mode	Output
Component	`https%3A%2F%2Fexample.com%2Fa%20b%3Fq%3Dcaf%C3%A9%20%26%20cr%C3%A8me%26x%3Dit's(1)*`
Full URL	`https://example.com/a%20b?q=caf%C3%A9%20&%20cr%C3%A8me&x=it's(1)*`
Form data	`https%3A%2F%2Fexample.com%2Fa+b%3Fq%3Dcaf%C3%A9+%26+cr%C3%A8me%26x%3Dit's(1)*`
RFC 3986	`https%3A%2F%2Fexample.com%2Fa%20b%3Fq%3Dcaf%C3%A9%20%26%20cr%C3%A8me%26x%3Dit%27s%281%29%2A`

Notice that Full URL mode left the & in “café & crème” alone, so a server would split the query there. That is why you should encode each value in Component mode before assembling the URL, rather than encoding the finished URL.

Common mistakes

Double encoding. Encoding an already encoded string turns %20 into %2520. If you see %25 everywhere, one layer too many was applied — decode once with the URL Decoder.
Using Full URL mode for values. encodeURI does not encode &, =, ? or #, so a value containing them breaks the query string.
Mixing up + and %20. In a query string produced by a form, + means space. In a path, + is a literal plus. Encode a real plus sign as %2B.
Forgetting UTF-8. Old systems sometimes percent-encode Latin-1 bytes (é as %E9). Modern browsers and this tool always use UTF-8, as the WHATWG URL standard requires.

URL encoding in code

JavaScript has encodeURIComponent and URLSearchParams (which uses + for spaces). In Python use urllib.parse.quote for paths and urlencode for query strings; in PHP, rawurlencode follows RFC 3986 while urlencode uses +; Java’s URLEncoder.encode produces form encoding. Knowing which one a system uses explains most “why is my space a plus?” bugs.

To inspect the parts of a finished address, paste it into the URL Parser. For structured payloads, JSON URL Encode validates the JSON before encoding it. Encoding runs entirely in your browser.

URL encode in Python

urllib.parse.quote() percent-encodes a string as UTF-8. Its default catches people out: / is treated as safe and left alone, which suits paths but breaks a value that contains a slash. Pass safe="" when you encode a single query value or path segment. quote_plus() writes spaces as + for form data, and urlencode() builds a whole query string from a dict, encoding each key and value for you.

from urllib.parse import quote, quote_plus, urlencode

value = "a/b café & crème"

print(quote(value))             # "/" is left alone by default
print(quote(value, safe=""))    # encode "/" too: use this for a single value
print(quote_plus(value))        # form style, space becomes +

# build a whole query string from a dict
params = {"q": "café & crème", "page": 2}
print("https://example.com/search?" + urlencode(params))

For this input, quote(value, safe="") matches the RFC 3986 strict mode of the encoder above and quote_plus() matches Form data; paste the result into the URL Decoder to check the round trip.

Frequently asked questions

What is the difference between encodeURI and encodeURIComponent?

encodeURI is meant for a whole URL and leaves characters such as : / ? # & = intact. encodeURIComponent is meant for one piece of a URL and encodes those characters too. For query values, always use the component version.

Should spaces be %20 or +?

Both are correct in their place. %20 works everywhere in a URL. + means space only in application/x-www-form-urlencoded data, such as query strings built by HTML forms. Use the Form data mode when a system expects +.

Why do non-English characters become several %XX codes?

URLs are percent-encoded byte by byte after converting text to UTF-8. Characters outside ASCII take two to four bytes, so “é” becomes %C3%A9 and an emoji becomes four %XX groups.

Which characters are never encoded?

The RFC 3986 unreserved characters: letters, digits, hyphen, period, underscore and tilde. They are safe in every part of a URL.

Why does my URL contain %2520?

It was encoded twice. %25 is the encoding of the percent sign, so %2520 is an encoded %20. Decode it once and make sure your code encodes each value only a single time.