About the URL Encoder
URL encode a value or a whole link to replace spaces, &, ?, # and non-English letters with percent-encoding such as %20 and %C3%A9. Choose Encode a value for one query parameter or path segment, or Encode a full URL to repair a link and keep its ://, ? and & working.
Percent-encoding is defined in RFC 3986. Text is first turned into UTF-8 bytes, and each byte outside the safe set is written as % plus two hex digits, so € becomes the three bytes %E2%82%AC. Both modes call your browser's own encodeURIComponent and encodeURI, which means the output matches what your JavaScript produces, and nothing you type is sent anywhere.
- Choose a mode first. The line under the two options lists the characters that mode leaves alone, so you know what to expect before you paste.
- Type or paste into Text to URL encode. Load sample depends on the mode: a price string like
café & crème = 5€/kg?for Encode a value, and a search URL with spaces for Encode a full URL. - Read Encoded text below. Line breaks are encoded too, as
%0A, or%0D%0Afor text copied on Windows, so remove a stray newline at the end before you copy. - Building a query string by hand? Encode each key and value on its own and join them with
=and&yourself. If you encode the finisheda=1&b=2in value mode, you geta%3D1%26b%3D2and the server sees one long key. - An error about a broken character (an unpaired surrogate) means the text holds half of an emoji, often because a string was cut at a fixed length in code. Delete that character and the output comes back.
Inputcafé & crème = 5€/kg?Outputcaf%C3%A9%20%26%20cr%C3%A8me%20%3D%205%E2%82%AC%2Fkg%3FEvery &, =, / and ? is encoded, so the value can't end its parameter early or start a new one.
Inputhttps://toolo.dev/tools?a=1&b=2OutputEncode a value: https%3A%2F%2Ftoolo.dev%2Ftools%3Fa%3D1%26b%3D2
Encode a full URL: https://toolo.dev/tools?a=1&b=2For a ?redirect= or an OAuth redirect_uri parameter, use Encode a value. With the second output, the server would read b=2 as its own parameter and cut the redirect short.
Inputhttps://example.com/hotels?city=São Paulo&q=北京 hotels#mapOutputhttps://example.com/hotels?city=S%C3%A3o%20Paulo&q=%E5%8C%97%E4%BA%AC%20hotels#mapEncode a full URL keeps ://, ?, =, & and #. Use it only when the structure of the link is already right and it just contains spaces or non-ASCII text.
Percent-encoding reference
Here are the codes for characters that cause trouble in URLs. Letters, digits and - . _ ~ are never changed by either mode.
- Space:
%20. In HTML form data it's written as+instead. - Encoded only by Encode a value:
#%23,$%24,&%26,+%2B,,%2C,/%2F,:%3A,;%3B,=%3D,?%3F,@%40. Encode a full URL leaves these alone because they hold the URL together. - Encoded by both modes:
"%22,<%3C,>%3E,[%5B,\%5C,]%5D,^%5E, the backtick%60,{%7B,|%7C,}%7D. - The percent sign itself:
%25, in both modes.50% offbecomes50%25%20off. - Line feed
%0A, carriage return%0D, tab%09. - Left as they are by both modes, though RFC 3986 reserves them:
!(%21),'(%27),((%28),)(%29) and*(%2A). - Non-ASCII text, as UTF-8 bytes:
é%C3%A9,€%E2%82%AC,北京%E5%8C%97%E4%BA%AC,👋%F0%9F%91%8B.
Which characters must be encoded
RFC 3986 sorts URL characters into groups. Unreserved characters, A-Z a-z 0-9 - . _ ~, are always safe and shouldn't be encoded. %41 and A mean the same, but some servers and caches treat them as different URLs.
Reserved characters, : / ? # [ ] @ ! $ & ' ( ) * + , ; =, separate the parts of a URL, so they must be encoded when they're part of your data. Everything else, including spaces, quotes, % and all non-ASCII text, is always encoded.
The RFC also asks for uppercase hex digits, %3A rather than %3a. Both decode the same, but uppercase is what browsers and most libraries write, and it keeps signed URLs and cache keys consistent.
encodeURIComponent or encodeURI, %20 or +
Use encodeURIComponent, the Encode a value mode, on every piece you insert into a URL: a query key, a query value, or a single path segment such as a user name. It leaves only A-Z a-z 0-9 - _ . ! ~ * ' ( ) unencoded.
Use encodeURI, the Encode a full URL mode, only on a complete URL that has spaces or non-ASCII characters in it. Never use it on a value, because &, =, ?, # and + pass straight through.
Most servers accept ! ' ( ) * unencoded. OAuth 1.0 signatures and AWS Signature Version 4 don't: they require every reserved character to be encoded, as in the strict JavaScript snippet in the In code tab.
HTML forms send application/x-www-form-urlencoded data, where a space is +. URLSearchParams, PHP urlencode, Python quote_plus and Java URLEncoder all write that form style. In a query string both + and %20 mean a space. In a path, only %20 does.
Encode once. Running the encoder over text that's already encoded turns each % into %25, so a b ends up as a%2520b. If a value arrives encoded, decode it with the URL Decoder before you change it.
URL encode in code
Each snippet encodes the value café au lait. Watch which functions write a space as %20 and which use +.
encodeURIComponent("café au lait");
// 'caf%C3%A9%20au%20lait'
const url = new URL("https://example.com/search");
url.searchParams.set("q", "café & crème");
url.href;
// 'https://example.com/search?q=caf%C3%A9+%26+cr%C3%A8me'
// Strict RFC 3986 (OAuth 1.0, AWS SigV4): also encode ! ' ( ) *
encodeURIComponent("it's (1*2)!")
.replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
// 'it%27s%20%281%2A2%29%21'from urllib.parse import quote, quote_plus, urlencode
quote("café au lait", safe="") # 'caf%C3%A9%20au%20lait'
quote_plus("café au lait") # 'caf%C3%A9+au+lait'
urlencode({"q": "café au lait"}) # 'q=caf%C3%A9+au+lait'
# quote() keeps "/" unless you pass safe=""rawurlencode("café au lait"); // 'caf%C3%A9%20au%20lait' (RFC 3986)
urlencode("café au lait"); // 'caf%C3%A9+au+lait' (form style)url.PathEscape("café au lait") // spaces become %20
url.QueryEscape("café au lait") // spaces become +URLEncoder.encode("café au lait", StandardCharsets.UTF_8); // form style: spaces become +Uri.EscapeDataString("café au lait"); // spaces become %20
WebUtility.UrlEncode("café au lait"); // spaces become +jq -rn --arg v 'café au lait' '$v|@uri'
# caf%C3%A9%20au%20lait
# Or let curl encode a query parameter:
curl -G 'https://example.com/search' --data-urlencode 'q=café au lait'Is URL encoding the same as percent-encoding?
Yes. Percent-encoding is the name RFC 3986 uses. Each byte that isn't allowed in a URL is written as % followed by two hex digits.
Should a space be encoded as %20 or +?
%20 is correct everywhere in a URL. + means a space only in query strings and form bodies that use the application/x-www-form-urlencoded format; in a path, + is a literal plus sign.
What is the difference between encodeURI and encodeURIComponent?
encodeURIComponent encodes everything with a meaning in a URL, including / ? & = #, and is for single values. encodeURI keeps those characters and is for a complete URL that only needs its spaces and non-ASCII text fixed.
Why does my URL contain %2520?
It was encoded twice. The first pass turned a space into %20, and the second turned that % into %25. Encode each value only once; the URL Decoder lets you peel the layers off one at a time.
How are Chinese, Cyrillic or emoji characters URL encoded?
Each character becomes its UTF-8 bytes, and each byte becomes %XX. 北京 is %E5%8C%97%E4%BA%AC, Москва is %D0%9C%D0%BE%D1%81%D0%BA%D0%B2%D0%B0, and 👋 is %F0%9F%91%8B. Browsers often show the readable form in the address bar but send the encoded one.
Which characters are safe in a URL without encoding?
Only A-Z, a-z, 0-9 and - . _ ~ are safe everywhere. Reserved characters such as /, ? and & are fine where they act as separators, but must be encoded when they're part of a value.
Do I need to URL encode a Base64 string?
Yes, if it's standard Base64: +, / and = all mean something in a URL, and a + can turn into a space. Encode it with Encode a value, or create Base64URL with the Base64 Encoder, which needs no encoding.