URL Encode / Decode
Encode and decode URLs and query strings safely, on your device.
How to use URL Encode
Encode and decode URLs, query strings and form data with a free online tool.
Open URL Encode on toolpermarket and enter your values in the fields below.
In the Input field, type or paste the string with spaces or symbols to encode or decode. Toggle between Encode and Decode to reverse the operation.
In the Mode field, choose Encode for safe URLs or Decode to recover the original. Encode query values, never the whole URL structure like slashes.
Press Encode to compute the result. The output appears immediately below the form. You can change any input and run it again to compare results.
Read the result and use it as needed. If the number looks off, re-check your inputs and run it again — the math is deterministic, so the same entries always return the same answer.
Worked example. Encoding hello world! returns hello%20world%21, turning the space and exclamation into safe percent-escapes.
Tips for accurate results.
Only encode the value, not the & or = that separate parameters.
Decode incoming parameters before displaying them to users.
Watch that plus signs and spaces are handled consistently.
When to use URL Encode. Building query strings that will not break on spaces. Embedding a URL inside another URL safely. Recovering readable text from logged request params.
When you actually reach for this
- You are building a query string or path by hand and need to percent-encode spaces and reserved characters.
- You must put arbitrary text into a URL without breaking the structure or injecting extra parameters.
Where this tool stops being accurate
- It encodes per the URL spec; characters like / and ? are encoded only if you choose full encoding, otherwise they stay as delimiters.
- Encoding does not validate the URL — an encoded malicious payload is still malicious once decoded by the server.
Frequently asked questions
What gets encoded and what stays?
Safe characters such as letters, digits and a few marks like hyphen and underscore are left alone. Unsafe characters — spaces, quotes, brackets, non-ASCII and control characters — become a percent sign followed by two hex digits. You should encode values, not the structural characters like ? & = / that hold the URL together.
Why is my space a plus in some places and %20 in others?
Historically form data used + for spaces while paths used %20; both decode to a space. This tool uses the percent-encoding form consistently. If a downstream system expects +, replace spaces with + after encoding — but %20 is the safer, unambiguous choice.
Is URL encoding encryption?
No. It only makes text safe to transport inside a URL; anyone can decode it. Never treat an encoded parameter as hidden or protected, and still validate decoded input on the server to avoid injection.
Should I encode the whole URL or just the values?
Encode each component (path segment, query value) separately, not the entire URL, or you will encode the slashes and ampersands you need.
Why did my space become %20 instead of +?
In a query value, + and %20 are interchangeable by spec; this tool uses %20 for clarity. Servers accept both in query strings.