Using the URL converter
Paste an encoded URL on the left and read it on the right. Swap the boxes to encode instead.
Two settings matter when the result looks wrong. Scope decides whether to encode a single value or a whole URL, because a full URL needs its :// and ? left alone. Spaces decides between %20 and +, and those are not interchangeable: + means space only inside a query string.
What percent-encoding does
A URL can only carry a small set of characters safely. Everything else is written as a percent sign and the hexadecimal for each byte, so a space becomes %20 and an ampersand becomes %26.
Anything outside ASCII is encoded byte by byte after being turned into UTF-8, which is why a single curly apostrophe arrives as %E2%80%99. Three bytes, three escapes, one character. Seeing that sequence in a page title is a good sign someone decoded the text twice.
Common escapes
Why there are two answers for a space
Space has two encodings and both are correct in their own place. The general rule from the URI standard is %20. The + comes from HTML form submission, where browsers post fields as application/x-www-form-urlencoded and a space became a plus.
So a link path uses %20, while the query string a form generated may well use +. Decode with the wrong assumption and you get a stray + in the middle of a sentence, which is the setting above.
Related conversions
Percent-encoding and Base64 solve the same problem for different channels: one makes text safe for a URL, the other makes bytes safe for anything that only carries text.
The escapes themselves are hexadecimal, and the characters behind them are Unicode code points.
Questions
Why does my apostrophe become %E2%80%99?
Because it's a curly apostrophe, three bytes in UTF-8, and each byte gets its own escape. A straight apostrophe is one byte and usually not encoded at all.
When should I use + instead of %20?
Only in a query string, and only if the receiver expects form encoding. In a path, always %20.
What does 'URI malformed' mean?
A percent sign without two valid hex digits after it, usually from a string that was cut short. The error above names the offending escape.
Is URL encoding a security measure?
No. It makes text safe to transport, not secret. Anyone can decode it, and it does not stop injection on its own.