Free Tool
URL Encoder
Web addresses can only contain certain characters safely, so everything else — spaces, symbols, non-English letters — has to be percent-encoded: a space becomes %20, an ampersand becomes %26. Type text below and this tool encodes it the way a browser does, in your browser.
Local-only encoding. This tool runs entirely in your browser — nothing you type is sent anywhere. It uses the browser's own encodeURIComponent, the same function websites use.
What this tool does
A web address, or URL, has a strict alphabet. Letters, digits and a few symbols are allowed as they are; everything else must be percent-encoded — written as a percent sign followed by two hexadecimal digits that name the byte. A space becomes %20, a question mark becomes %3F, and a non-English character such as é becomes two encoded bytes, %C3%A9, because URLs carry bytes and é takes two bytes in UTF-8.
This encoder shows you that transformation for any text you type. It uses the browser's own encodeURIComponent function, which is the same function websites use when they build a link with a search term or a form value in it. That means the result matches what a real site would produce, and it means the tool handles UTF-8 correctly — including emoji, which become four encoded bytes each.
Percent-encoding matters for security as well as correctness. An attacker who wants to hide a dangerous character in a link — a slash, a question mark, an at-sign — will encode it, hoping the reader does not notice and the server decodes it later. Learning to recognise percent-encoding, and to decode it with the companion tool on this site, is part of learning to read a link before you click it. The URL structure analyser on this site goes further, breaking a whole address into its parts and flagging the tricks.
Try it
Type text and encode it for use in a web address.
Waiting. Press Encode for a URL.
How it works
The encoder works byte by byte. Your text is first converted to UTF-8 bytes — one byte for ordinary English letters, two for accented letters, three or four for most other scripts and emoji. Then each byte is checked: if it is an unreserved character — a letter, a digit, a hyphen, an underscore, a full stop or a tilde — it is left as it is. Every other byte is written as a percent sign followed by its two hexadecimal digits, so a space (one byte, value 32) becomes %20 and é (two bytes, values 195 and 169) becomes %C3%A9.
That rule is called percent-encoding, and it is defined by the web standard RFC 3986. The browser's encodeURIComponent follows it exactly, and also encodes a few characters that are allowed in some parts of a URL but not in others — such as the slash, question mark and hash — because this tool is for encoding a value to put inside a URL, not for encoding a whole URL. Encoding a whole address with it would break the address, by encoding the slashes and colons that give it its structure.
The distinction matters. To encode a complete URL you would use a different function, encodeURI, which leaves the structure characters alone. This tool deliberately uses the stricter one, because its job is to encode a piece of text — a search term, a name, a message — so it can be safely placed inside a larger address without breaking it.
Limitations
Percent-encoding changes how text travels, not what it means. An encoded character decodes to the same character on the other end, so encoding does not hide anything from a server, a filter or a person who decodes it. It also does not make a dangerous link safe: an encoded slash is still a slash once the server decodes it, and a phishing link stays a phishing link however it is encoded.
- This tool encodes a value for use inside a URL. Do not use it on a whole address — it will encode the slashes and colons that give the address its structure.
- Spaces become %20 here. In form data, a space is sometimes written as a plus sign instead — the two conventions differ, and this tool follows the URL convention.
- Nothing you type is sent anywhere. The computation is local, and the page works offline once loaded.
Examples
Example 1 — hello world & friends. Encoding this gives hello%20world%20%26%20friends. The spaces became %20 and the ampersand became %26 — the ampersand must be encoded because, unencoded, it would mean the start of a new parameter in the address.
Example 2 — café. Encoding café gives caf%C3%A9. The é is two bytes in UTF-8, so it becomes two percent-encoded triplets. This is why non-English text in a web address looks long and cryptic: every byte outside the plain alphabet is written out in full.
Example 3 — what encoding hides. A link might contain %2F%2Fevil.example — two encoded slashes followed by a domain. Decoded, that reads //evil.example, which would send the browser somewhere else entirely. Encoding hides the trick from a quick glance, which is why the URL decoder on this site exists: paste a suspicious-looking address, decode it, and read what it really says.
Frequently asked questions
What is percent-encoding?
Writing a byte as a percent sign followed by two hexadecimal digits, so that characters outside a URL's safe alphabet can travel inside an address. A space becomes %20, an ampersand %26, and é becomes %C3%A9.
Why do URLs need encoding at all?
Because a URL can only contain certain characters safely. Spaces, symbols and non-English letters would break the address or change its meaning, so they are encoded and decoded back at the other end.
Is URL encoding the same as encryption?
No. Encoding is a change of representation — anyone can decode it, as the URL decoder on this site shows. It protects nothing and hides nothing from anyone who decodes it.
Why does a space become %20 and not a plus sign?
In a URL, %20 is the standard encoding for a space. A plus sign means a space only in form data (application/x-www-form-urlencoded). This tool follows the URL convention.
Can encoding hide a phishing link?
It can hide it from a quick glance, which is exactly why you should decode suspicious addresses before trusting them. Encoding changes how a link looks, not where it goes.