The URL Encoder and Decoder percent-encodes URL text or decodes percent-encoded values locally.
Use component encoding for query values and full-URL encoding only when appropriate. Encoding an entire URL can also encode separators that need to remain structural.
Limitations
Decoding untrusted text does not make it safe for HTML, SQL, shell commands, or redirects; validate it for the destination context.
Method
The encoder percent-encodes characters that are unsafe in the selected URL context. Query parameter values should generally be encoded as components, while a complete URL must retain structural separators such as :, /, ?, and & when appropriate. Decoding reverses valid percent escapes.
Example
The query value red apples & tea becomes red%20apples%20%26%20tea as a component. Encoding the ampersand prevents it from being interpreted as a second parameter.
Interpretation
URL encoding is different from HTML escaping, JavaScript escaping, SQL parameterization, and shell escaping. Apply the protection required by the destination context after decoding.
Common questions
Should I encode a whole URL?
Usually encode individual query or path components so separators remain meaningful.
Does encoding make input safe?
No. It preserves transport syntax but does not validate URLs or prevent injection elsewhere.