Encoding

URL Encode / Decode

Percent-encode text for safe use in URLs, or decode it back. Conversion happens live in your browser.

URL Encode / Decode options

Direction
Mode

encodeURIComponent — escapes everything except A–Z a–z 0–9 - _ . ! ~ * ' ( )

Keyboard shortcuts

Esc
Close a menu or overlay, then leave full screen
↓ on a menu
Open it; ↑ ↓ move through its items
← → in the menu bar
Move between menus

Where your data goes
Using this page Using the API, MCP or A2A
Where it runs In your browser. Conversion is plain JavaScript (encodeURIComponent, encodeURI, decodeURIComponent) running as you type. In a Cloudflare Pages Function at the Cloudflare data centre nearest the caller.
What leaves your device Nothing you enter. After the page and its scripts load, no request carries your input. The browser enforces this: the page's Content-Security-Policy sets connect-src 'none' and form-action 'none', which block fetch, XHR, WebSocket, EventSource, beacons and form posts.

The server receives the input text and mode, converts it in memory inside the request, and returns the result. Your input is not stored or logged; only the per-call metadata row (operation, time, status, sizes) is recorded. Send secrets in a POST body, not the query string: URLs are recorded in Cloudflare request logs, proxies, and shell history.
Stored Nothing leaves the page. No cookies, analytics or third-party scripts; the browser keeps only your View → Inline config choice. Your inputs and results: never. What is stored is your client record (client ID, a SHA-256 hash of your secret, expiry, and the profile you registered with) and one metadata row per call: operation, time, transport, status, error code, duration, request and response sizes, and country.
Logged Nothing (no requests are made). Only the per-call metadata above, attributed to your client ID. Never parameters, bodies, results, or credentials. Cloudflare, as the host, also processes request metadata (IP address, full URL including the query string, headers) under its own policies, so put inputs in POST bodies.
Access Open to anyone. Requires a client ID and secret (how to get one). HTTPS only; TLS terminates at Cloudflare.

Details and how to verify this yourself: Security & privacy.

User guide

The tool sits in a window that works like a desktop app: menus on the top row and the full-screen icon at its right (Esc leaves full screen). The set-up options described below are in Settings → Options…, an overlay, and the Settings menu also lists the common choices directly. To keep the options in view instead, choose View → Inline config; the page remembers that choice. Help → Keyboard shortcuts… lists the keys.

  1. Choose Encode or Decode.
  2. Choose a mode. If you are unsure, use Component.
  3. Type or paste into Input. The output updates on every keystroke.
  4. Copy puts the output on your clipboard. Use output as input swaps the panes and flips the direction, which is a quick way to check a round trip.

Which mode do I need?

You are encoding…ModeExample input → output
One query-string value or path segmentComponenta&b=c → a%26b%3Dc
A whole URL that is already structuredFull URIhttps://x.io/a b?q=é → https://x.io/a%20b?q=%C3%A9
An HTML form body (application/x-www-form-urlencoded)Forma b+c → a+b%2Bc

Never encode a whole URL with Component: it escapes : / ? & and breaks the URL. Never build query strings with Full URI: it leaves & and = alone, so a value containing them changes the meaning of the query.

Decoding tips. Decode with the same mode that was used to encode. In particular, + means a space only in Form mode; in the other modes it stays a literal +. If you see malformed % sequence, the text contains a % not followed by two hex digits (for example 100%), or bytes that are not valid UTF-8.

Specification

Character encoding. Text is converted to UTF-8 first. Each byte outside the unreserved set becomes %XX with uppercase hex digits (RFC 3986 §2.1).

ModeEncoding behaviourCharacters left as-is
componentECMAScript encodeURIComponentA–Z a–z 0–9 - _ . ! ~ * ' ( )
uriECMAScript encodeURIthe above plus ; , / ? : @ & = + $ #
formencodeURIComponent, then %20 → +as component
ModeDecoding behaviour
componentdecodeURIComponent: every %XX is decoded.
uridecodeURI: escapes for reserved characters (%2F, %3F, %26, …) are kept, so the URL’s structure cannot change.
formevery + becomes a space, then decodeURIComponent.

Errors.

  • Encode fails only for a lone UTF-16 surrogate, which cannot be represented in UTF-8.
  • Decode fails when a % is not followed by two hex digits, or when the decoded bytes are not valid UTF-8.

Differences from other tools.

  • form mode matches the WHATWG URL standard’s application/x-www-form-urlencoded serializer, except that ! ' ( ) ~ are left unescaped (WHATWG escapes them).
  • Other encoders differ on the same characters; for example, PHP’s urlencode escapes all five. Every variant decodes to the same text.

Limits. None in the browser beyond memory. The API accepts request bodies up to 1 MiB.

API & MCP

The same logic is available over HTTP and as MCP tools. Unlike this page, these run on the server: see where your data goes.

GET POST /api/url/encode Percent-encode text (RFC 3986). MCP tool url_encode · 2 parameters · full reference → GET POST /api/url/decode Decode percent-encoded text. MCP tool url_decode · 2 parameters · full reference →