URL percent encoder & decoder
hello world & café becomes hello%20world%20%26%20caf%C3%A9, safe to drop into a link. Choose between encoding a single value, where & = ? / are escaped too, or a whole address that keeps its colons, slashes and question mark. Decoding reverses it. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- hello world & café
- Calculation mode
- Encode
- Result
- hello%20world%20%26%20caf%C3%A9
- Length
- 31
- Profile
- component
- Standard
- encodeURIComponent / decodeURIComponent
URL percent-encoding turns spaces, ampersands, non-ASCII letters, and other reserved or unsafe characters into a portable %HH form so query strings, path segments, and callback parameters survive transit through browsers, proxies, and APIs. Without it, a search term with spaces splits a query, an email subject with accents corrupts a mailto link, and a product name with a slash looks like a new path. Pick component mode when you are encoding a single parameter value, or full-URI mode when you need structural separators such as colon-slash and question mark to stay intact.
How percent-encoding and the two URL profiles work
Percent-encoding, defined for the web in the URI standards that browsers and RFC 3986 follow, replaces each byte that is not allowed in a given context with a percent sign and two hexadecimal digits. For UTF-8 text, multi-byte characters become several %HH groups in sequence, so café becomes caf%C3%A9 and a plain space becomes %20. Two common profiles matter in everyday work.
The component profile matches encodeURIComponent: it escapes almost everything that is not an unreserved character, including reserved delimiters such as ampersand, equals, question mark, slash, and colon. That is what you want when the string is a single query parameter value or a single path segment that must not be mistaken for structure. The full-URI profile matches encodeURI: it still escapes spaces and non-ASCII, but it leaves structural punctuation alone so an entire address such as https://example.com/path?
Decoding reverses the map. Before host decode runs, this capability scans the input for well-formed escapes: every percent sign must be followed by exactly two hex digits.
Where URL percent-encoding shows up in real work
Backend services assembling redirect targets, OAuth callback URLs, and signed return paths must encode each parameter value independently so an ampersand inside a product title cannot invent a second query field. Frontend apps that build search and filter links from free-text boxes need component encoding on every value while leaving the path template untouched. Email and SMS templates that embed deep links with user names, campaign tags, or Unicode subjects rely on percent-encoding so carriers and clients do not rewrap or corrupt the href.
Support teams paste half-encoded strings from tickets and need a decode path that fails loudly on truncated % escapes instead of inventing characters. Localization engineers verify that multi-byte languages round-trip through encode and decode without mojibake. Curriculum authors teaching web foundations want one dedicated page for percent-encoding with both component and full-URI profiles rather than burying the topic under a generic Base64 or slug tool, because search intent and reserved-character rules differ.
If you need Base64, Base32, slug generation, UTM assembly, or full URL structure validation, treat those as separate search intents and landings rather than overloading this percent encoder page.
What you can do with it
Safe query parameter values
Percent-encode each filter, search term, or product name with component mode so reserved characters never split or rewrite the query string.
Decode pasted or logged URLs
Decode percent-encoded fragments from logs and tickets back to readable text, with hard failures on incomplete or non-hex percent sequences.
Full-URL light normalization
Encode a complete address with component false so spaces and non-ASCII escape while scheme, path, and query delimiters stay intact.
FAQ
What is the difference between component true and false?
True uses encodeURIComponent semantics and escapes reserved separators such as & = ? / : so a single value is safe inside a parameter or path segment. False uses encodeURI semantics and keeps structural URL punctuation while still escaping spaces and non-ASCII.
Can I both encode and decode?
Yes. Set mode to encode (default) to percent-escape plain text, or mode to decode to recover text from a percent-encoded string.
Does this replace building a full URL object?
No. It only transforms text with percent-encoding rules. Assemble scheme, host, path, and query yourself, encoding each value with the component profile when needed.
What does it cost?
The browser tool is free and runs locally.
What happens if a percent sequence is broken?
Decoding stops with a clear message and the position of the problem. A lone % at the end, or sequences such as %G1 or %2, are refused instead of half-decoded, so a pasting error never turns into different text.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/url \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"hello world & café"}'const res = await fetch("https://api.kit.forhosting.com/enc/url", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "hello world & café"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/url",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "hello world & café"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/url", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"hello world & café"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"hello world & café"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/url", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "hello world & café"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.url",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
This capability applies the same rules JavaScript exposes as encodeURIComponent and encodeURI: encode mode escapes the characters your profile requires, decode mode restores plain text, and any malformed percent sequence fails immediately with invalid_input instead of returning half-decoded garbage.
How percent-encoding and the two URL profiles work
x=1 can be lightly normalized without destroying the scheme, path, or query skeleton. A trailing lone percent, or sequences such as %G1 or %2, raise invalid_input with a position and a short explanation. That strict check is intentional; silent acceptance would hide paste errors and produce different results across languages that disagree on how to treat broken escapes. The path is pure string work with no network, no random seeds, and no wall-clock timestamps, so identical inputs always produce identical JSON. Pricing for successful API calls is the published base of $0.002 per item, and validation failures do not consume prepaid balance.
What you send and what you get back
Send a required string field named text and optional mode and component fields. Mode encode percent-escapes text according to the selected profile and returns the transformed string in result. Mode decode validates every percent sequence, then reverses encoding and returns plain UTF-8 text in result. Component defaults to true for the strict component profile; set it to false for the full-URI profile that preserves structural delimiters. Classic checks include encoding hello world with a space and ampersand under component mode, decoding caf%C3%A9 back to café, encoding a full URL under component false so the scheme and query separators survive, and rejecting a string that ends with a bare percent. When mode is omitted, encode is the default so a single payload still does useful work. The response echoes mode, component, the original text, result, the length of result, a short profile label of component or uri, and a standard label naming the matching JavaScript built-ins so clients can assert which contract they hit. Missing text, non-string objects, unsupported mode values, values that cannot be interpreted as a boolean for component, strings longer than the documented maximum, incomplete percent escapes, non-hex digits after a percent sign, and host-level URI errors on invalid decoded UTF-8 all fail with invalid_input and a clear English message. Validation failures do not consume prepaid balance. Successful API pricing is the published base of $0.002 per item.
Where URL percent-encoding shows up in real work
Because this capability is a pure parse engine, API pricing is the published base of $0.002 per successful item and failed validation does not consume balance.
Technical questions
What happens if a percent sequence is malformed?
Decode fails with invalid_input, naming the position and the bad escape (for example an incomplete % or non-hex digits). Nothing is charged for validation failures.