About URL encoding
URLs can only contain a limited set of ASCII characters. Special characters like spaces, ampersands and non-ASCII letters must be percent-encoded — replaced with a percent sign followed by two hexadecimal digits representing the character's byte value. For example, a space becomes %20 and the letter a-umlaut becomes %C3%A4.
This tool uses encodeURIComponent, which encodes everything except letters, digits and the characters - _ . ! ~ * ( ). It is the correct function to use when encoding a query string parameter value or a path segment, not an entire URL.
How do I percent-encode a URL component?
To percent-encode text for use in a URL, replace every character outside the unreserved set (letters, digits, and - _ . ! ~ * ' ( )) with a percent sign followed by two hexadecimal digits representing that character's UTF-8 byte value. Example: "hello world" becomes "hello%20world" and "café" becomes "caf%C3%A9".
Steps to percent-encode and decode a URL component
- Convert the input text to UTF-8 bytes, since non-ASCII characters may be represented by more than one byte.
- Scan each byte; if it corresponds to an unreserved character (A-Z, a-z, 0-9, - _ . ! ~ * ' ( )), leave it unchanged.
- For every other byte, replace it with a percent sign followed by its two-digit uppercase hexadecimal value, for example a space (0x20) becomes %20.
- Join the results back into a single string; this is the percent-encoded, URL-safe representation of the original text.
- To decode, scan for % followed by two hex digits, convert each back to its byte value, and reassemble the UTF-8 bytes into the original text.
Percent-encoding rule
Reserved/unsafe byte -> %XX, where XX is the byte's value in two uppercase hexadecimal digits
- Unreserved characters = A-Z, a-z, 0-9, - _ . ! ~ * ' ( ) — never encoded
- %XX = percent sign plus two hex digits representing one byte of the UTF-8 encoding of the original character
Example encoding results
| Text | Encoded |
|---|
| hello world | hello%20world |
| a=b&c=d | a%3Db%26c%3Dd |
| café | caf%C3%A9 |
| 100% off! | 100%25%20off! |
| user@example.com | user%40example.com |
Frequently asked questions
Why does encodeURIComponent leave ! ~ * ' ( ) unescaped?
These characters, along with letters, digits, and - _ ., are defined as safe to appear directly in a URI component and carry no special meaning there, so JavaScript's encodeURIComponent leaves them as-is. Other functions like encodeURI reserve a different, larger set of characters because they are meant for encoding a full URL rather than one component.
What is the difference between encoding a URL component and an entire URL?
Encoding a single component (like a query parameter value) should escape characters such as & and = so they are not mistaken for URL structure. Encoding an entire URL must leave structural characters like :, /, ?, and & untouched so the URL still parses correctly, which is why encodeURIComponent and encodeURI behave differently.
Why does a space sometimes become %20 and sometimes +?
%20 is the general percent-encoding for a space used in the URL path and in encodeURIComponent output. The + sign for a space is a legacy convention specific to the application/x-www-form-urlencoded format used in HTML form submissions and query strings, not a general URL encoding rule.
Why does decoding fail with an error on some input?
Decoding fails when a % is not followed by two valid hexadecimal digits, or when the decoded bytes do not form valid UTF-8 — for example, pasting an incomplete percent sequence like %E2%9 without its final byte. Check that the input is complete, correctly percent-encoded text.
This tool encodes and decodes a single text value using JavaScript's encodeURIComponent/decodeURIComponent, matching RFC 3986 unreserved characters; it does not parse or validate a full URL's structure (scheme, host, path, query) as separate components.
Sources: RFC 3986 - Uniform Resource Identifier (URI): Generic Syntax
Privacy and safety
- Runs in your browser — Everything you type is calculated on your own device. Your inputs are never sent to a utilduck server.
- Encrypted connection — Pages are served over HTTPS, so nobody on the network can read what you load.
- Not shared with third parties — Your inputs are not passed to analytics or advertising services.
- Nothing is stored — Results are not saved to any server, and there is no account to create.
Last updated: 2026-08-17