Overview
Encode text into a percent-escaped format safe for use in query strings, path segments, and form values, or decode a percent-encoded string back into readable text. This tool uses encodeURIComponent/decodeURIComponent rather than encodeURI, so it escapes every reserved character (including &, =, ?, and /) - the right choice when you’re encoding a single value to drop into a query parameter, not a full URL that already contains its own structure. Everything runs client-side, so your data never leaves the browser. Use it to debug query parameters, build API request URLs by hand, or clean up double-encoded links.
Best for: Safely embedding a value inside a query string
How to use this tool
- Choose Encode or Decode. Pick the direction you need with the mode toggle.
- Paste the text or URL. Drop in a raw value to encode, or a percent-encoded string to decode.
- Read the live result. Output updates as you type, with malformed percent-encoding on decode flagged clearly.
- Copy or swap. Grab the result, or swap it back in to reverse the operation.
Why use this tool
Uses encodeURIComponent, correctly
Escapes every reserved character, the right choice for a single query value rather than a whole URL.
Clear decode error messages
Malformed percent-encoding is explained specifically, not just rejected with a generic error.
Handles sensitive values safely
Session tokens and API keys in query strings are decoded locally, never sent to a server.
Swap to reverse instantly
Move straight from encode to decode (or back) without retyping anything.
Frequently asked questions
encodeURIComponent escapes every character that isn’t valid inside a single URL component - including &, =, ?, #, and / - which is what you want when encoding one value (like a query parameter) to embed inside a larger URL. encodeURI leaves those characters alone because it assumes you’re encoding a whole URL that already relies on them for structure, so it would under-encode a single value.
Decoding throws when the input contains a "%" that isn’t followed by two valid hexadecimal digits, or a percent-encoded sequence that doesn’t form a valid UTF-8 byte sequence - this usually means the string was cut off, edited by hand, or wasn’t percent-encoded to begin with.
No - encoding and decoding both happen locally in your browser. This is particularly relevant here because query strings frequently carry things you wouldn’t want logged on a third-party server: session tokens, API keys, password-reset codes, or a signed URL with embedded credentials. Pasting one into this tool to decode it is no different from decoding it in your own browser console - it never leaves your machine.