~/tools/-url-encode-
Encoding tool - URL Encoder / Decoder

$ Encode and decode URLs

Paste a URL or query string to encode it, or paste an encoded URL to decode it back to readable form.

// controls

Settings

Choose mode and encoding type.

Component encodingEncodes all special characters including /, ?, and &. Use for individual query parameter values.
vultio · -url-encode-

Encoded output

Output will appear here.

—
§ 01
context

Why this tool exists

Vultio URL Encoder / Decoder encodes plain text and URLs using standard percent-encoding, or decodes percent-encoded strings back to readable form, entirely in your browser.

URL encoding is essential when working with query parameters, API request building, link sharing, and debugging HTTP requests where special characters must be safely represented.

It becomes especially important when one unsafe character silently changes the meaning of a request. A space, ampersand, plus sign, slash, or redirect URL copied without proper encoding can turn a valid flow into a broken link, rejected callback, or confusing 400 error.

This tool helps by making the boundary explicit: what should stay structural in the URL, and what should be encoded as data so servers and browsers interpret it correctly.

§ 02
scenarios

Common use cases

01 →Encode query parameter values before appending them to a URL to avoid breaking the URL structure.
02 →Decode a percent-encoded URL you received in an API response or browser address bar.
03 →Encode a full URL for use as a redirect_uri or callback parameter in OAuth flows.
04 →Debug API endpoints by decoding complex encoded query strings into readable parameters.
05 →Prepare safe URLs for embedding in HTML href attributes or HTTP headers.
06 →Normalize partner or support links before sharing them in docs, templates, or automation steps.
§ 03
examples

Example input / output

Encode a query parameter value (Component mode)

$ input
hello world & more=data
↳ output
hello%20world%20%26%20more%3Ddata

Encode a full URL (Full URL mode)

$ input
https://example.com/search?q=hello world&lang=en
↳ output
https://example.com/search?q=hello%20world&lang=en

Decode a percent-encoded query string

$ input
redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback
↳ output
redirect_uri=https://app.example.com/callback

Protect a redirect URL inside another URL

$ input
https://login.example.com?redirect_uri=https://app.example.com/callback?tab=billing
↳ output
https://login.example.com?redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback%3Ftab%3Dbilling
§ 04
troubleshooting

Common errors

! Error: input is not a valid encoded URL.

cause:The string contains a malformed percent sequence such as %GH or a lone % character that is not followed by two valid hex digits.

fix:Check that all percent signs are part of valid sequences (% followed by exactly two hex characters A–F or 0–9). Switch to Encode mode if you meant to encode the text.

! Encoded output breaks the URL structure unexpectedly.

cause:Using Component mode on a full URL encodes the / and ? characters, which destroys the URL structure.

fix:Switch to Full URL mode when encoding a complete URL. Use Component mode only for individual query parameter values or path segments.

! Space appears as + instead of %20.

cause:Some older systems and form submissions use application/x-www-form-urlencoded format, which replaces spaces with +.

fix:This tool follows the standard RFC 3986 percent-encoding spec (%20 for spaces). If you need + encoding for form data, replace %20 with + after encoding.

! A URL gets encoded twice and stops working

cause:Already encoded values were passed through another encoding step, turning % into %25 and making the target system decode the wrong thing.

fix:Check whether the string is already percent-encoded before encoding again. Double encoding is common in redirect and callback flows.

! The decoded output is readable but still behaves incorrectly in a browser

cause:The problem may be structural rather than encoding-related, such as a bad host, missing scheme, broken query parameter name, or invalid redirect registration.

fix:Use decoding to inspect the string, then verify the actual URL semantics separately: host, path, parameters, and allowed redirect targets.

§ 05
workflow

How developers use it in practice

→ Decide whether you are encoding a full URL or a component

Most encoding mistakes happen when developers use full-URL encoding rules on a single query value or vice versa. Make that choice explicit before copying the result.

→ Decode first when debugging ugly callback strings

OAuth, SSO, and payment redirects often become much easier to reason about once you decode the nested query parameters into plain text and inspect which layer is actually broken.

→ Watch for double-encoding in multi-hop flows

If a URL passes through frontend code, a proxy, and a third-party service, each layer may try to encode it again. A quick decode/encode check often reveals where the duplication started.

§ 06
tradeoffs

When not to use this tool

01 →Do not use percent-encoding as a substitute for full URL validation or security review.
02 →Do not encode an entire URL with component rules if you need the scheme, slashes, and separators to remain structural.
03 →Do not assume form-encoding rules and generic URL-encoding rules are interchangeable in every API.
§ 07
limits

Limits and implementation notes

~ Encoding preserves syntax, not meaning

A perfectly encoded URL can still point to the wrong domain, wrong route, or wrong callback target.

~ Nested URLs require extra care

Redirect and callback parameters often contain a URL inside another URL, which is where single-vs-double encoding bugs appear most often.

~ Browser and server conventions may differ

Most modern stacks follow RFC 3986-style percent encoding, but legacy systems and form handlers may still treat spaces and plus signs differently.

§ 08
read more

Related guides

§URL Encoder Decoder Online: The Complete GuideHow percent-encoding works, encodeURIComponent vs encodeURI, and a full reference table of reserved characters that must be encoded in URLs.→§Common URL Encoding Errors and How to Fix ThemA practical reference for diagnosing and resolving the most frequent URL encoding mistakes in APIs and web applications.→§Base64 Encoding: 7 Real-World Use Cases for DevelopersUnderstand when Base64 is the right encoding choice compared to URL encoding.→
§ 09
references

Standards & references

↗RFC 3986 – Uniform Resource Identifier (URI): Generic SyntaxThe IETF standard that defines URI syntax, percent-encoding rules, and the reserved character set that must be encoded in query strings and path segments.↗↗MDN – encodeURIComponent()Mozilla's reference for the encodeURIComponent function, which implements the same encoding rules used in component mode on this tool.↗↗WHATWG URL Living StandardThe authoritative specification for how browsers parse, serialize, and encode URLs — maintained by the Web Hypertext Application Technology Working Group.↗
§ 10
toolbox

Related tools

→Base64 Encoder / DecoderEncode text to Base64 or decode Base64 back to plain text, entirely in the browser.→→JSON FormatterFormat raw JSON to make it easier to inspect.→→Secret GeneratorGenerate passwords, API keys, and JWT secrets.→
§ FAQ
questions

Frequently asked questions

What is URL encoding?

URL encoding replaces special characters with percent-encoded sequences so they can be safely included in URLs. For example, a space becomes %20 and & becomes %26.

What is the difference between component and full URL encoding?

Component encoding (encodeURIComponent) escapes all special characters including /, ?, and &, making it suitable for query parameter values. Full URL encoding (encodeURI) preserves structural characters like /, ?, and & that have meaning in the URL.

Does URL encoding send data to a server?

No. This tool processes everything client-side in your browser. Nothing is sent to any server.

When should I use URL Encoder?

Use it when building query strings, debugging encoded API endpoints, or when you receive a URL with percent-encoded characters and need to read it clearly.

Why do some spaces become + and others %20?

Form data (application/x-www-form-urlencoded) uses + for spaces, while RFC 3986 percent-encoding uses %20. This tool uses standard percent-encoding (%20) which is safe in all contexts.