Skip to main content

URL Encoder

English

Encode or decode URL strings.

→ HTML Entity Encoder→ Base64
All calculations performed locally in your browser. No data sent to server.

Results are for informational purposes. Verify results with other sources.

One Polish sentence of 17 characters becomes 66 in a URL

Percent-encoding works on bytes, not characters, and UTF-8 spends more than one byte on anything outside ASCII. Each byte becomes three characters, so accented text expands violently: zażółć gęślą jaźń is 17 characters, 26 bytes, and 66 characters once encoded — a factor of 3.88.

How it works

  • Percent-encodes text for safe use in URLs, and decodes it back.
  • Encodes to UTF-8 first, which is where the size expansion comes from.
  • Distinguishes encoding a whole URL from encoding a single component, which are different jobs with different safe sets.
each unsafe byte → % followed by two hex digits

UTF-8 byte counts:
  ASCII        1 byte  → 1 char unencoded
  ł, ü         2 bytes → 6 chars   (%C5%82)
  €, 日        3 bytes → 9 chars   (%E2%82%AC)
  emoji        4 bytes → 12 chars  (%F0%9F%98%80)

71 of the 95 printable ASCII characters pass through untouched

Worked example

The same characters, encoded, and then the classic double-encoding failure.

  1. a → a (1 character, unchanged)
  2. ł → %C5%82 (6 characters)
  3. 😀 → %F0%9F%98%80 (12 characters)
  4. "a b" → "a%20b"
  5. encoding that again → "a%2520b"

The second encoding turns the % of %20 into %25, producing %2520. Decoding once gives back a%20b, not a b — the string looks decoded but is still wrong, which is why double-encoding bugs survive so long before anyone notices.

Reading the result

  • Space is %20 in a path and + in form-encoded query data, and the two are not interchangeable. Decoding a + as a literal plus where a space was meant, or the reverse, is the second most common encoding bug after double-encoding.
  • Encode components, not whole URLs. Running a full URL through component encoding destroys the :// and the separators; running a component through full-URL encoding leaves & and = intact, which lets user input inject extra parameters.
  • The expansion has practical limits attached. Servers and proxies commonly cap URLs near 2,000 characters, so a query string carrying accented text hits that ceiling several times sooner than the character count suggests.
  • Encoding is not escaping for other contexts. A percent-encoded string is safe in a URL and says nothing about safety in HTML, SQL or a shell — each destination needs its own encoding, applied at the point of use.

Common questions

Why did my text turn into %2520?
It was encoded twice. The first pass turned a space into %20; the second pass saw the % as an ordinary character and encoded it as %25, leaving %2520. Decode twice to recover the original, then fix whichever layer is encoding redundantly.
Should a space be %20 or +?
%20 everywhere except in form-encoded query strings, where + is the historical convention and still widely produced. Both decode to a space in that context, but only %20 is correct in a path segment.

Sources