URL Encode / Decode
Percent-encode or decode, and break a URL into its parts and query params.
Runs entirely in your browser — nothing you paste is uploaded.
About URL Encode / Decode
Two jobs in one tool. Percent-encoding converts text into a form that survives being put in a URL — spaces become `%20`, `&` becomes `%26`, and anything non-ASCII becomes its UTF-8 bytes in hex. Decoding reverses it, which is how you read a redirect chain or a callback URL that has another URL nested inside it three layers deep.
The inspector takes a whole URL and pulls it apart: protocol, host, port, pathname, hash, and every query parameter decoded into a table. That table is where the value is — a long analytics or OAuth URL is unreadable as one string and obvious once the parameters are in rows.
The distinction that trips people up is `encodeURI` versus `encodeURIComponent`. The first encodes a complete URL and deliberately leaves `:`, `/`, `?`, `&` and `#` alone because they're structural. The second encodes a single value and escapes those characters too. Use `encodeURIComponent` for anything going into a query parameter — using `encodeURI` there is how a value containing `&` silently becomes two parameters.
It runs in the browser. The URLs people need to decode are session callbacks, signed asset links and password-reset tokens, and none of those belong in a request to someone else's server.
Frequently asked
›encodeURI or encodeURIComponent?
`encodeURIComponent` for a single value going into a query string or a path segment — it escapes `&`, `=`, `?`, `/` and `#`. `encodeURI` for a whole URL you want to keep working, since it leaves those structural characters intact. Using the wrong one is the cause of most parameter-injection bugs.
›Why is a space sometimes `%20` and sometimes `+`?
`%20` is the correct percent-encoding everywhere in a URL. `+` means space only in `application/x-www-form-urlencoded` bodies and query strings, a legacy of HTML forms. In a path segment, a `+` is a literal plus sign.
›Which characters need encoding?
Everything outside the unreserved set — letters, digits, `-`, `.`, `_` and `~`. Reserved characters (`: / ? # [ ] @ ! $ & ' ( ) * + , ; =`) need encoding when they appear as data rather than as structure.
›How do I handle a URL inside a URL?
Encode the inner one with `encodeURIComponent` before putting it in the parameter. It'll look unreadable — that's correct. Skipping it means the inner URL's own query string gets parsed as part of the outer one.
›What about non-ASCII domain names?
Hostnames use Punycode, not percent-encoding — `münchen.de` is transmitted as `xn--mnchen-3ya.de`. The inspector shows the host as the browser's URL parser resolves it, which is the Punycode form.