Paste a link or text full of %20 and %3D to decode it. The link is split into its parts, with every parameter and its value in a table. Or encode text for a link.
The link, part by part
URL encoding, also called percent encoding, writes a character that cannot stand in a link as a % sign and its byte in hex: a space becomes %20. Letters, digits and - . _ ~ never need it. A letter like é is two bytes in UTF-8, so it becomes two codes, %C3%A9. It is not encryption: anyone can decode it. Click a code to copy it.
| Character | Encoded | In a link |
|---|---|---|
| space | Space. A form writes it as + | |
| Starts the part after the # | ||
| The percent sign itself | ||
| Separates the parameters | ||
| A space in form data | ||
| Separates the folders in the path | ||
| After the scheme, as in https: | ||
| Between a name and its value |
| Character | Encoded | In a link |
|---|---|---|
| Starts the parameters | ||
| In an email address | ||
| line break | Line break | |
| return | Carriage return, before %0A on Windows | |
| tab | Tab | |
| Two bytes in UTF-8 | ||
| Three bytes | ||
| Four bytes |
Paste the link in the left field. The decoded link appears on the right right away, and under it the link is split into its parts: the domain, the path, every parameter with its value, and what comes after the #. Each value has its own Copy button.
A link from Outlook, Facebook or Google often has the real link packed inside it. That link gets its own list of parts. To take the tracking off it, use Clean URL.
Pick Encode URL, then what you are encoding:
- . _ ~ is encoded, also & = / ?, so the value cannot break the link around it.: / ? # & = stay, and only spaces, letters like é, quotes and the like are encoded. % codes that are already there are kept, so nothing is encoded twice.Tick As + instead of %20 for form data, the format a form and many APIs send (application/x-www-form-urlencoded). Both mean a space in the parameters.
JavaScript:
encodeURIComponent('a b&c') // a%20b%26c
decodeURIComponent(s.replace(/\+/g, ' '))
Python:
from urllib.parse import quote, unquote_plus
quote('a b&c', safe='') # a%20b%26c
unquote_plus(s)
PHP:
rawurlencode('a b&c'); // a%20b%26c
urldecode($s); // also turns + into a space
encodeURI() is the whole-link version in JavaScript. encodeURIComponent() leaves ! ' ( ) * as they are, where this page, PHP and Python encode them. Both are valid.
Paste it in the field at the top of this page. Every %20, %3D and other code is turned back into the character it stands for, and the link is split into its domain, path and parameters, each with its value decoded. Several links can go in at once, one per line.
It is a space. A link cannot hold a space, so it is written as % and the character's number in hex, and a space is number 20. Others you see often are %2F for /, %3A for :, %3D for =, %26 for & and %3F for ?. The URL encoding table above has the rest, and letters like é, which take two codes: %C3%A9.
There is nothing to decrypt. The % codes in a link are not encryption, just a way of writing characters a link cannot hold, and anyone can decode them here. If what is left still looks scrambled, it is usually one of two things: a value in Base64, which Base64 Decode reads, or a tracking link with the real address packed inside it, which Clean URL unpacks. A shortened link, like bit.ly, cannot be decoded at all: only the service that made it knows where it goes.
It was encoded twice. The first time, a space became %20. The second time, the % sign in that code was encoded too, as %25, so %20 became %2520. It happens when a link is put inside another link, or when a program encodes something that was already encoded. This page decodes every layer in one go and says how many there were. Click Decode one layer only to stop after the first.
Both mean a space in the parameters, the part after the ?. The + comes from forms, which send their fields as application/x-www-form-urlencoded, so you see it in search links and many APIs. In the path, before the ?, only %20 is a space, and a + is a plus. When decoding, this page follows that rule. When encoding, it writes %20 unless you tick As + instead of %20.
encodeURI() is for a whole link: it keeps the characters that give a link its shape, such as : / ? & = and #. encodeURIComponent() is for one value that goes into a link, so it encodes those too, and an & in a search word cannot cut the link in two. They match the two choices here, A whole link and One value. To decode, use decodeURIComponent(), and replace + with a space first if the text came from a form.
decodeURIComponent() in JavaScript stops with that error when a % is not followed by two hex digits, as in 100% or a link that was cut off in the middle of a code, or when the codes are not valid UTF-8, such as %E9 for é from an old form. This page decodes the rest anyway, leaves a broken % sign as it is, reads old codes as Western European (Windows-1252), and says what it did in the line under the result.
No. It is decoded and encoded by JavaScript in your own browser, and nothing is sent to this server or anyone else's. That matters for links, because the parameters often hold an email address, a name or a login token.