The Free URL Encoder Decoder: How to URL Encode, URL Decode and Get Percent Encoding Right
A search link that breaks at an ampersand. A redirect that loses half its address. A shared link full of %20 that nobody can read. All three come down to percent encoding, the rule that decides which characters a web address may hold as they are and which must be written as % plus two hex digits. This guide shows how to url encode and url decode with the url encoder decoder above, which encoding suits each job, and how to fix the errors that bring most people here.
1. Percent Encoding: Component, Full URL or Form?
A web address allows only a small set of characters, and some have jobs: ? starts the query, & separates parameters, = joins a key to its value and # starts the fragment. Percent encoding, defined in RFC 3986, replaces any other character with its UTF-8 bytes written as %XX. A space becomes %20, a comma %2C. What people get wrong is how much of the text to encode, the question behind encodeURIComponent vs encodeURI. The tool offers both, plus form encoding; its sample shows the difference: https://cortexis.pk/search?q=free tools&lang=en&tags=pdf,image#top.
Encode component
Escapes everything except A to Z, a to z, 0 to 9 and - _ . ! ~ * ' ( ). Use it for one value, or for a URL placed inside another URL. It is the default.
Encode full URL
Keeps / ? # & = : intact and escapes only what cannot appear at all. On the sample, "free tools" becomes "free%20tools" and the link still works.
Form encoding
Component encoding, except spaces become + instead of %20: the format HTML forms submit.
The rule of thumb: encode the pieces, not the whole. Run a complete address through component encoding and its slashes are escaped too, so it stops being a link. Encode each value on its own, and an ampersand inside a company name can no longer start a new parameter.
2. How to URL Encode and URL Decode in Three Steps
How to encode a URL and how to decode a URL encoded string from a log take the same steps, with no account to create.
- Paste your text. Replace the sample with your link, value or encoded string. The box is one piece of text, so a line break becomes
%0Awhen encoded. - Choose the operation. Pick an Encode mode or Form encoding to encode; Decode or Form decode to read. The output refreshes as you type, with no convert button.
- Copy or download. Use Copy to grab the result, or Download to save it as
output.txt.
A common case is how to pass a URL as a query parameter: a login link carrying a return address such as ?next=https://example.com/a?b=1. Encode only the inner address with Encode component and place it after next=; its ? and = are escaped, so the outer link keeps one query. Likewise, to url encode for an API request with curl, encode each parameter value before adding it to the command.
Encoding works on UTF-8 bytes, so you can encode emoji or Arabic and Urdu text in a URL: each character becomes two to four %XX groups, and Decode restores the original script.
3. %20 vs + in a URL, and the Vanishing Plus Sign
How to encode spaces in a URL has two correct answers, which is exactly why it causes trouble. In the path and in general percent encoding a space is %20. In form data, the application/x-www-form-urlencoded format web forms use when a form is submitted, a space is +. So %20 vs + in a URL is really a question about who will read the value: use %20 anywhere in a link, and + only when you are building a form body. The Form encoding mode is a ready form urlencoded encoder for that second case.
The flip side: a plus sign in a URL turns into a space when a phone number like +923001234567 is sent unescaped and read as form data. Encode the value first, which turns + into %2B.
The decoder respects that difference: plain Decode keeps a literal +, while Form decode turns every + into a space, as a submitted form would. If a result looks wrong, try the other one.
And if you are asking why does my link have %20: nothing is broken. The link contained a space, written the only way a web address can hold one. Choose Decode to read it normally.
4. URI Malformed, %2520 and Other Broken Links
The URI malformed error from decodeURIComponent means the text contains a % that is not followed by a valid encoded byte. The tool shows the same message as a red line and leaves your previous output in place. There are two usual causes:
- A lone percent sign. Text such as
50% offwas never encoded. Encode it instead, which turns the percent sign into%25. - A legacy character set. Older systems wrote characters like é as a single byte,
%E9, instead of the UTF-8 pair%C3%A9. This decoder reads UTF-8 only, and no tool here converts those strings; fix them at the source.
A double encoded URL with %2520 is the other classic. It happens when an already encoded value is encoded again: the % of %20 becomes %25, giving %2520. To undo it, run Decode, paste the output back into the input and Decode again. There is no one-click repair, but you can watch each layer come off.
A URL with special characters not working? The usual culprit is an unescaped &, #, space or non-English letter inside a value. Encode the value with Encode component, or the whole address with Encode full URL.
5. The Query String Parser: UTM Links and Redirects
Under the input sits a query string parser. For a complete address starting with https://, the Parsed URL panel lists protocol, host, path and hash, then every query key beside its decoded value. For the sample you see q set to free tools, lang set to en and tags set to pdf,image, with #top as the hash.
That makes it quick to decode a UTM tracking link: paste a long campaign URL and read utm_source, utm_medium and utm_campaign as plain words. Developers use it to decode an OAuth redirect_uri parameter, the callback address encoded inside a login link, and compare it with the one registered for the app.
The panel reads; it does not edit, so removing tracking tags means rebuilding the link yourself. It also needs an absolute address: a relative path or a bare string like a=1&b=2 shows “Input is not an absolute URL, so there is nothing to parse”. Put any full address in front of a bare query, such as https://example.com/?a=1&b=2, and it parses. The parsing follows the WHATWG URL Standard, the specification that defines how web addresses are read today. If a parameter carries JSON, copy its decoded value into the JSON formatter to read it properly indented.
6. Base64url, HTML Entities, Punycode and the Limits
The same menu covers neighbouring escapes:
- Base64 encode and decode, UTF-8 aware, so non-Latin text survives the round trip.
- Base64url encode online: the URL-safe variant used in tokens, with
-and_in place of+and/and no=padding. - HTML entity encoder decoder: encoding escapes
& < > " 'and the backtick, and turns non-ASCII letters into numeric entities. Decoding understands named and numeric entities alike, which is how to unescape HTML entities like & and " in text exported from a CMS or an email. - Punycode converter: turns an IDN domain to Punycode, the
xn--ASCII form that DNS and registrars expect.
What it does not do, and where to go instead:
- It encodes Base64url but does not decode it; URL-safe strings fail in Base64 decode. For token segments use the JWT decoder, and for files or images the Base64 encoder and decoder, since this tool takes text only.
- Punycode is one-way:
xn--names are not converted back to Unicode here, and no other Cortexis tool does it either. Keep a note of the original spelling when you convert a domain. - The Parsed URL panel is read-only, so stripping tracking tags or changing a value means editing the link in the input box and watching the table update, rather than ticking parameters off.
- There is no line-by-line bulk mode. The line tools can tidy and de-duplicate the list first.
- It does not escape for JSON, SQL or regular expressions; the regex tester and SQL formatter serve those jobs. It does not shorten links, though the QR code generator will turn the finished address into a scannable code.
7. Why Cortexis Is the Best Free URL Encoder Decoder
Plenty of pages offer a url encoder online free or a url decoder online. What matters is whether the page tells you which mode you need, and whether it leaves your data as you typed it.
Both directions, one page
Encode and decode share one menu, and the output updates as you type. No sign-up.
The right encoding for each job
Component, full URL and form encoding are separate modes, with a note saying which characters each keeps.
Honest about + and %20
Decode keeps a literal plus sign; Form decode turns it into a space. You choose, instead of the tool guessing and changing your data.
A query string parser built in
Every parameter is laid out as key and decoded value, so tracking links and redirects read at a glance.
Private by policy
Nothing you paste is stored on our servers, retained, or used for training.
More than percent encoding
Form encoding, Base64 and Base64url, HTML entities and Punycode sit behind the same menu as the URL modes.
It is a URL encoder that never stores what you paste, and one of a wider set of free developer and file tools offered on the same terms.
8. Frequently Asked Questions (FAQ)
What is the difference between URL encoding and URL decoding?
URL encoding turns characters a web address cannot hold, such as spaces and ampersands, into %XX codes. URL decoding reverses it, so free%20tools becomes free tools again.
Should I use encodeURIComponent or encodeURI?
Use Encode component for a single value or an address placed inside another address. Use Encode full URL to keep a complete link working, since it leaves / ? # & = and : alone.
Is a space %20 or + in a URL?
In a link, a space is %20. In form data sent as application/x-www-form-urlencoded, it is +. Use Form encoding only for form bodies.
Is there a form urlencoded encoder for application/x-www-form-urlencoded bodies?
Yes. Choose Form encoding: it escapes each value like Encode component, then writes spaces as + instead of %20, which is what an application/x-www-form-urlencoded body expects. Encode each key and value separately and join them with = and &. Form decode reverses it, turning + back into a space.
How do I unescape HTML entities like & and "?
Paste the text and choose HTML entities decode. Named entities such as & and " and numeric ones such as ' turn back into & and " and ', so text copied from a CMS export or an email reads normally again.
Why does my plus sign turn into a space?
The receiving side reads the value as form data, where + means a space. Encode it first so the plus becomes %2B. When decoding, plain Decode keeps a plus as a plus.
How do I fix a URI malformed error?
The text contains a % that is not a valid encoded byte, such as a literal 50% or a legacy code like %E9. Encode the raw text if it was never encoded; legacy character sets need fixing at their source.
How do I fix %2520 in a link?
That is a double encoded space. Decode the string, paste the output back in and Decode again; each pass removes one layer.
Can it decode Base64url or a JWT?
It encodes Base64url but does not decode it. Use the JWT decoder for token segments and the Base64 encoder and decoder for other Base64 work, including files.
Is it safe to paste links that contain tokens?
Yes. Links, tokens and text you paste are never stored on our servers, nothing is retained, and nothing is used for training. Treat the decoded output with the same care as the original link.
Next, fingerprint a value with the hash generator, create unique IDs for parameters with the UUID generator, or compare two URLs with the diff checker. To learn how requests and query strings fit together, try our free full-stack web development course.