URL kodieren und dekodieren
URL Encoder and Decoder percent-encodes and decodes text in your browser. The mode matters more than it looks: in a query string a space is +, in a path it is %20, and decoding a form body with the wrong one turns “a + b” into “a b” without any error.
Die Oberfläche dieses Tools ist auf Englisch.
Die folgende Anleitung ist nur auf Englisch verfügbar.
How does URL Encoder and Decoder work?
“URL encoding” names three different encodings, and picking the wrong one produces a bug that never throws.
Percent-encoding is not form-encoding
RFC 3986 percent-encoding writes a space as %20. Theapplication/x-www-form-urlencoded format — what a query string and a form POST body actually use — writes it as +, which means a literal plus has to be written %2B. Decode a form body with decodeURIComponent and the + survives untouched, so the search “a + b” arrives as “a + b” when the user typed a plus, and as “a+b” when they typed spaces. One of those is wrong and neither raises an error.
encodeURIComponent leaves five characters the RFC reserves
!, ', (, ) and * are reserved by RFC 3986 and left alone by encodeURIComponent. Usually harmless; not harmless when a signature is computed over the encoded form, which is why every AWS SigV4 and OAuth 1.0a library ships its own encoder. The strict option encodes them.
Each URL component has its own rules
A path may contain /; a query value may not contain an unencoded & or it splits into two parameters. That is the difference between component mode and full-URL mode: the first encodes everything that is not unreserved, the second preserves the characters that give a URL its structure. Encoding a whole URL with encodeURIComponent produces a string that is no longer a URL.
Double-encoding, and how to see it
%2520 is a space that went through an encoder twice: the % of %20 was itself encoded as %25. It reads as “%20” to a person skimming a log and produces a literal %20 in the decoded value. The tool counts how many decode passes the input survives, so a stray extra layer is visible rather than mysterious.
Splitting a URL uses the platform's parser
The component breakdown comes from the browser's own URLimplementation rather than a regular expression, because URL parsing has enough edge cases — userinfo, IPv6 literals, default ports, percent-encoded hosts — that the WHATWG algorithm already in the platform is both shorter and more correct than any pattern. Duplicate query keys are preserved in order, since plenty of APIs give them meaning.
Input
q=a + b
Encoded
component: q%3Da%20%2B%20b form: q%3Da+%2B+b
What options and edge cases does URL Encoder and Decoder support?
| Parameter | Type | Default | Behaviour & edge cases |
|---|---|---|---|
| Component | encodeURIComponent | default | For one query value or one path segment. Encodes everything except A–Z a–z 0–9 - _ . ~ and the five characters below. |
| Full URL | encodeURI | — | For a whole URL. Keeps : / ? # [ ] @ ! $ & ' ( ) * + , ; = so the URL stays a URL. Using component mode here destroys the structure. |
| Form | x-www-form-urlencoded | — | For a query string or a POST body. A space is +, a literal + is %2B. Decoding correctly requires undoing + before percent-decoding, or a literal plus becomes a space. |
| base64url | RFC 4648 §5 | — | The URL-safe base64 alphabet: - and _ rather than + and /, with padding stripped. What JWT segments use. |
| Strict RFC 3986 | boolean | off | Also encodes ! ' ( ) *, which encodeURIComponent leaves alone. Required when the encoded form feeds a signature. |
| Encode everything | boolean | off | Percent-encodes every byte including unreserved ones. Ugly, valid, and occasionally the only thing a fussy gateway accepts. |
| Character set | UTF-8 | always | Non-ASCII is encoded as its UTF-8 bytes, one %XX each, which is what every current browser and server expects. |
| Malformed input | reported | with position | decodeURIComponent throws a bare URIError. The offending sequence is located and named instead. |
Frequently asked questions
Why is my space a + instead of %20?
Because you are in form mode, which is correct for a query string or a form POST body — that format defines a space as +. In a path segment or a fragment, a space is %20 and a + is a literal plus. Both encodings are correct; using the wrong one for the position is what corrupts the value.
encodeURI or encodeURIComponent?
encodeURIComponent for one piece — a query value, a path segment, a fragment. encodeURI for a whole URL you want to remain a URL. The test is simple: if the text you are encoding contains characters that are structural (a ?, a &, a /) and you want them to keep working, you need encodeURI; if you want them to become data, you need encodeURIComponent.
What is %2520 and how did I get it?
A space, encoded twice. The first pass made %20; the second encoded that % as %25, giving %2520. It usually means a value was encoded by application code and then again by a framework or a proxy. The depth counter above shows how many passes your input survives, so you can tell whether one layer is too many.
Why are !'()* not encoded?
encodeURIComponent deliberately leaves them, even though RFC 3986 reserves them. It is almost always harmless — until the encoded string is the input to a signature, where the signer and the verifier must agree byte for byte. That is why AWS SigV4 and OAuth 1.0a both specify their own encoder. Turn on strict mode if you are in that situation.
Is base64url the same as base64?
Same algorithm, different alphabet. base64 uses + and /, which are both meaningful in a URL, so base64url swaps them for - and _ and drops the = padding, which is meaningful in a query string. A JWT is three base64url segments joined by dots, which is why a JWT can be pasted straight into a URL and a base64 blob cannot.
Is my input uploaded?
No. Encoding and decoding are string operations that run in your browser — open the Network panel and watch while you type. It matters here because URLs people need to decode are frequently signed callback URLs, OAuth redirects and session tokens, which is to say credentials in a form that looks harmless.