URL Encode and Decode

How do I URL encode a string?

1. Paste the text, value or URL into the Input box.
2. Set Direction: Encode a value (encodeURIComponent) for a query-string parameter, Encode a whole URL (keeps / ? & =) for a complete address, or Decode.
3. Click Convert, or wait a moment for the output to update on its own.
4. Check the output panel: spaces should show as %20 and any special characters as % followed by two hex digits.
5. Click Copy output and paste the result into your link, code or API call.

URLs can only contain a limited set of ASCII characters, so anything else, including spaces, accented letters, emoji and the reserved characters that have special meaning in a URL, has to be written as a percent sign followed by the hexadecimal value of each UTF-8 byte. A space becomes %20, an ampersand %26, a pound sign %C2%A3 and é becomes %C3%A9. This is percent-encoding, defined in RFC 3986, and browsers, servers and APIs all rely on it.

The two encoding modes exist because the right answer depends on what you are encoding. Encode a value uses encodeURIComponent and escapes everything that is not a letter, digit or one of - _ . ! ~ * ' ( ), including ? & = / and #. Use it for a single parameter value, such as a search term or a redirect URL you are putting inside another URL's query string. Encode a whole URL uses encodeURI and leaves the structural characters alone, so https://example.com/path?q=fish and chips becomes https://example.com/path?q=fish%20and%20chips with the slashes and question mark intact.

A common mix-up is + versus %20. HTML forms submitted with the default encoding turn spaces into +, which is why you see them in some search URLs, but that convention only applies to query strings submitted from forms. This tool always produces %20, which is valid everywhere. Decode reverses either encoding mode but, like the browser's own decodeURIComponent, leaves a + as a literal plus sign, so replace those with spaces first if you are decoding a form-submitted query string.

Decode also helps when reading the tracking parameters in a marketing link or the encoded redirect target in a login URL: paste the whole thing and the readable version appears. Everything runs as JavaScript in your browser tab, so the URLs you paste, which often contain session tokens and email addresses, are never transmitted or stored.

How it works: this tool uses plain JavaScript running in your browser tab. No server is involved, so Kilnfile never sees your file. Last reviewed 20 September 2026.

Frequently asked questions