A URL can only carry a limited set of characters safely. Spaces, ampersands, equals signs, hash marks and non-ASCII letters all have to be percent-encoded before they go into a query string or path segment, otherwise the link breaks or the server reads the wrong value. This URL encoder and decoder handles that conversion for single URL components, using the same rules as JavaScript's encodeURIComponent and decodeURIComponent.
Decoding works in the other direction, turning sequences like %20, %26 or %C3%A9 back into spaces, ampersands and accented letters. An option lets you treat + as a space, which is how HTML forms encode spaces. Everything runs in your browser, so redirect URLs, signed links and tokens you inspect are not uploaded anywhere.
How to use: URL Encoder and Decoder
- Choose Encode URL component or Decode URL component in the Operation menu.
- Paste the value you want to convert into the text field, or press Load sample.
- When decoding form data or query strings that use + for spaces, check Treat + as a space when decoding.
- Press Convert and check the output in the Result panel.
- Press Copy to place the result on your clipboard, or Download to save it as a text file.
Example: price & tax = 5% encodes to price%20%26%20tax%20%3D%205%25.
Which characters get encoded?
Encoding follows encodeURIComponent. Letters A–Z and a–z, digits 0–9 and the characters - _ . ! ~ * ' ( ) are left as they are. Everything else is converted to UTF-8 bytes and each byte is written as % followed by two hexadecimal digits.
- Space becomes %20, which answers the common question of what %20 means in a URL.
- Reserved characters are encoded too: & becomes %26, = becomes %3D, ? becomes %3F, # becomes %23, / becomes %2F and + becomes %2B.
- Non-ASCII characters become several bytes: é is %C3%A9 and most emoji take four %XX groups.
- A literal percent sign becomes %25, so already encoded text gets double-encoded if you run it again.
Encode a component, not the whole URL
Because slashes, colons and question marks are encoded, pasting a full address such as https://example.com/search?q=a b returns a string that no longer works as a link. That is by design: encode only the part you insert, such as a search term or a single path segment. When you pass an entire URL as a parameter value, as in ?next=, encoding the whole thing is exactly right.
%20 or +? Decoding form data
In URL paths and in encodeURIComponent output, a space is %20. HTML forms submitted with application/x-www-form-urlencoded, and many server-side libraries, write spaces as + instead. Standard decoding leaves + unchanged, so a query like q=hello+world decodes to hello+world. Check Treat + as a space when decoding to get hello world. Leave it off when a + is meant literally, such as in a phone number or a Base64 value inside a URL.
If decoding fails with "Malformed URL data", the input contains a % not followed by two hex digits, or a byte sequence that is not valid UTF-8, often from text encoded in a legacy charset like Windows-1252. Fix or remove the broken sequence and try again.
Frequently asked questions
What does %20 mean in a URL?
%20 is the percent-encoded form of a space character. URLs cannot contain literal spaces, so each space is replaced by a percent sign followed by its byte value in hexadecimal, which is 20 for a space. Decoding the URL turns every %20 back into a space. In form data you may also see spaces written as a plus sign.
What is the difference between URL encoding and percent encoding?
They are the same thing. Percent encoding is the formal name used in RFC 3986, while URL encoding is the everyday term. Both replace unsafe or reserved characters with a % sign and two hexadecimal digits for each UTF-8 byte. Some people use URL encoding to also mean the form variant that writes spaces as +.
Does this work like encodeURIComponent?
Yes. Encoding uses encodeURIComponent and decoding uses decodeURIComponent, so the output matches what you get in JavaScript. It encodes reserved characters like /, ?, & and =, which makes it right for query values and path segments. It differs from encodeURI, which keeps those characters so a full URL stays usable.
Why did my URL stop working after encoding?
You probably encoded the entire URL. Component encoding turns the colon and slashes in https:// into %3A%2F%2F, so the result is no longer a valid address. Encode only the values you insert into the URL, such as query parameters, and keep the scheme, host and separators as they are.
Why are plus signs not turned into spaces?
Standard URL decoding only converts %20 into a space; a plus sign is a literal character in URL paths. Forms and some libraries use + for spaces in query strings, though. If your data comes from a form submission or a query string built that way, check Treat + as a space when decoding before you convert.
Is it safe to decode URLs that contain tokens?
Yes, the decoding happens in your browser and the URL is not sent to Falanca. That is useful for inspecting OAuth callback URLs, signed download links or password reset links. Treat the decoded values as secrets: do not paste them into public tickets, and remember that anyone holding a live token link may be able to use it.