How-to guide

How to URL Encode Text

URL encoding replaces characters that have meaning in a URL — spaces, ampersands, question marks, slashes — with a percent sign and their hexadecimal byte value. Encode each query value on its own rather than the whole URL, or the separators that make the URL work will be encoded too and the address will stop functioning.

URL Encoder and Decoder

Percent-encode text for URLs, or decode it back.

Open the tool

A URL is a structured string, and a handful of characters do structural work: ? starts the query, & separates parameters, = joins a name to its value, # begins the fragment, / separates path segments. Any of those appearing inside a value has to be escaped, or the receiving server reads it as structure.

The mistake almost everyone makes once is encoding the whole URL instead of the individual values. That escapes the separators as well, producing a single meaningless string rather than a working address.

Step by step

Identify what you are encoding
A single value going into a query parameter or path segment, or a complete URL. These need different treatment, and using the wrong one is the usual cause of a broken link.
Use component encoding for values
Component encoding escapes everything with structural meaning, including & ? = / and #. This is what you want for a search term, a redirect target or anything a user typed.
Use full-URL encoding only for a whole URL
This leaves the separators intact and escapes only characters that are never legal, such as spaces. Use it to tidy a URL you already have, never to prepare a value for insertion.
Watch the plus sign
In a query string a + means a space, a legacy of HTML form submission. In a path segment it is a literal plus. That is why a value containing + can arrive with it silently converted, and why %2B is safer when you mean a literal one.
Encode once, not twice
If your output contains %2520, a space became %20 and then the % became %25. Something encoded an already-encoded value. Decode until the value stops changing to find the original.

Example

The same URL, encoded the right way and the wrong way.

Encoding just the value

/search?q=caf%C3%A9%20%26%20bar

Works: ? and & still separate,
only the value is escaped.

Encoding the whole URL

%2Fsearch%3Fq%3Dcaf%C3%A9%20%26%20bar

Broken: the separators are escaped,
so there is no query string left.

Frequently asked questions

What is the difference between component and full-URL encoding?

Component encoding escapes the structural characters too — & ? = / # — and is what you want for a value going into a URL. Full-URL encoding leaves those alone so an existing URL keeps working, and only escapes characters that are never legal.

Why does my plus sign become a space?

Because in a query string it means one, inherited from HTML form encoding. Anything reading the query decodes + as a space. To pass a literal plus, encode it as %2B.

What does %25 in my URL mean?

A percent sign that was itself encoded — the signature of double encoding. A space became %20, then the % became %25, giving %2520. Decode repeatedly until the value stops changing.

Do I need to encode non-English characters?

Technically yes, and every tool does it as UTF-8 bytes, which is why é becomes %C3%A9. Browsers display the readable form in the address bar but send the encoded one, so both are the same URL.

Is URL encoding a security measure?

No. It makes a value safe to transmit inside a URL, nothing more. It does not sanitise content for HTML, SQL or a shell — each of those needs its own escaping, applied at the point the value is used.

Tools used in this guide

All tools →

All guides →

Last reviewed 7 August 2026.