RFC 3986 · percent-encoding · query strings
Escapes unsafe characters as %XX hex pairs for use in URLs and query strings. Toggle options below for different URL contexts.
Text → URL-encoded box — the percent-encoded result appears instantly in URL-encoded.Encode all non-alphanumeric to escape every non-alphanumeric character, not just the reserved ones.+ for space to emit + instead of %20 for spaces — on by default, matching application/x-www-form-urlencoded.Copy result to copy the encoded string to your clipboard.URL-encoded → Text and the decoded text appears below it.Clear any time to reset a box and start over.Encode values for ?key=value pairs so &, =, and spaces don't break the URL structure.
Decode %20, %2F, and friends to read a URL as plain text and see what's actually in the path or query.
Unreserved characters — A–Z a–z 0–9 - _ . ~ — pass through untouched; everything else becomes a %XX pair.
Non-ASCII characters (including emoji) are encoded as their UTF-8 bytes, each written as its own %XX escape.
Spot %25 (an encoded %) to catch values that were encoded twice and are breaking downstream parsers.
Everything runs in your browser. Nothing is uploaded, logged, or sent to a server — safe for sensitive tokens and URLs.
Percent-encoding (also called URL encoding) writes unsafe characters as a % followed by two hex digits — the byte's value. A space becomes %20, and / becomes %2F.
By default, the RFC 3986 unreserved set — A–Z, a–z, 0–9, -, _, ., ~ — passes through unchanged. Check Encode all non-alphanumeric to escape everything except letters and digits.
+ instead of %20?HTML form data (application/x-www-form-urlencoded) uses + for spaces, and that option is on by default. Turn it off to get plain %20, matching RFC 3986 for raw URLs.
No. It's fully reversible and provides no security — anyone can decode it. It only makes text safe to transport inside a URL, not hidden.
Yes. Characters outside ASCII are encoded as their UTF-8 bytes, each as a separate %XX escape. Decoding reverses this back to the original text.
The line under the encoded output counts how many distinct %XX escapes your input produced — a quick way to see the variety of bytes being escaped.
Never. All encoding and decoding happens locally in JavaScript. Your input is not sent to, stored on, or logged by any server.