Using the URL converter
Paste an encoded URL on the left and read it on the right. Swap the boxes to encode instead.
Two settings matter when the result looks wrong. Scope decides whether to encode a single value or a whole URL, because a full URL needs its :// and ? left alone. Spaces decides between %20 and +. They aren't interchangeable, because + means space only inside a query string.
What percent-encoding does
A URL can only carry a small set of characters safely. Everything else is written as a percent sign and the hexadecimal for each byte, so a space becomes %20 and an ampersand becomes %26.
Anything outside ASCII is encoded byte by byte after being turned into UTF-8, which is why a single curly apostrophe arrives as %E2%80%99. Three bytes, three escapes, one character. Seeing that sequence in a page title means something encoded the text once more than anything decoded it.
Common escapes
Common escapesstringmash.com/url-decode
Why there are two answers for a space
Space has two encodings and both are correct in their own place. The general rule from the URI standard is %20. The + comes from HTML form submission, where browsers post fields as application/x-www-form-urlencoded and a space became a plus.
So a link path uses %20, while the query string a form generated may well use +. Decode with the wrong assumption and you get a stray + in the middle of a sentence. Spaces, above, is the setting that fixes it.
Related conversions
Base64 does a similar job for bytes, making them safe for anything that only carries text, while percent-encoding only has to get text through a URL.
The escapes themselves are hexadecimal, and the characters behind them are Unicode code points.
encodeURI vs encodeURIComponent
JavaScript has two functions for this, and they differ in what they leave alone. encodeURI is for a whole URL: it keeps the characters that give a URL its structure, such as : / ? & = and #, and only escapes the rest. encodeURIComponent is for one piece, such as a query value: it escapes those structural characters too, so a value containing & or / can't break the URL. Scope above does the same: A whole URL is encodeURI, A single value is encodeURIComponent.
Use encodeURIComponent for each value you put into a query string, and encodeURI, if at all, for a full URL that only needs its spaces and other stray characters escaped.
Questions
Why does my apostrophe become %E2%80%99?
Because it's a curly apostrophe, three bytes in UTF-8, and each byte gets its own escape. A straight apostrophe is one byte and usually not encoded at all.
When should I use + instead of %20?
Only in a query string, and only if the receiver expects form encoding. In a path, always %20.
What does 'URI malformed' mean?
A percent sign without two valid hex digits after it, usually from a string that was cut short. The error above names the offending escape.
Is URL encoding a security measure?
No. It makes text safe to transport, not secret. Anyone can decode it, and it doesn't stop injection on its own.
Sources
- RFC 3986: Uniform Resource Identifier (URI): Generic Syntax
- WHATWG: URL Standard (application/x-www-form-urlencoded)
Added . Last updated and reviewed . What's new