URL Encoder & Decoder
Safely encode and decode URLs, special characters, and query parameters (incl. Base64).
TextUpdated: October 2026
Erkannte URL-Query-Parameter (3)
queryPDF zusammenführen
categorytools
filterkostenlos
Safely encode and decode URLs, special characters, and query parameters (incl. Base64).
Safely encode and decode URLs, special characters, and query parameters (incl. Base64).
Enter your URL, query parameter, API endpoint, or plain text into the workspace, or drag and drop a text file directly into the tool.
Choose your desired operation: Percent-Encode special and non-ASCII characters into hexadecimal %HH escape sequences, or Decode percent-encoded strings back into human-readable text.
Toggle between encodeURI (for complete URLs, preserving routing characters like /, :, and ?) and encodeURIComponent (for individual parameter values, strictly escaping all reserved characters per RFC 3986).
Verify the encoded or decoded string in the output panel and copy the result with one click for immediate deployment in web development or API configurations.
GDPR compliant processing • Strict browser privacy • Secure European server hosting
The Uniform Resource Identifier (URI) specification constitutes the universal routing foundation of the internet. Formally codified by the Internet Engineering Task Force (IETF) in RFC 3986, the URI architecture is anchored in a highly restricted subset of standard US-ASCII characters. Characters within a web address are categorized into unreserved characters (alphanumerics A–Z, a–z, 0–9, hyphen, underscore, period, and tilde), which carry no syntactical meaning, and reserved characters (such as colons, slashes, question marks, hashes, and ampersands), which serve as structural delimiters separating protocol schemes, hostnames, directory paths, and query parameters. Whenever arbitrary data—such as spaces, typographical accents, or punctuation—must be transported across an address bar, it must be percent-encoded. This mechanism replaces each non-conforming byte with a percent symbol followed by two hexadecimal digits (%HH), ensuring error-free transmission across international networks.
In modern web software engineering, selecting between encodeURI() and encodeURIComponent() represents a critical technical distinction. The encodeURI() method is intended to sanitize a complete, fully constructed URI. It percent-encodes illegal characters such as spaces or emojis while intentionally preserving structural routing syntax like http://, slashes (/), and question marks (?), ensuring the resulting string remains an operable hyperlinked resource. In stark contrast, encodeURIComponent() applies an aggressive, zero-tolerance isolation strategy: it percent-encodes every reserved delimiter, including slashes, colons, ampersands, and equal signs. This function is strictly mandatory whenever dynamic values—such as user search queries, authorization callback targets, or tracking tokens—are appended into a query string. Applying encodeURI() to a query parameter containing an ampersand will corrupt backend parsing by mistakenly splitting the parameter into two separate key-value pairs.
While basic Latin ASCII characters convert into a single %HH octet during percent-encoding, international scripts, diacritics, and graphical emojis demand multi-stage processing. Modern web specifications mandate that characters must first be decomposed into their constituent UTF-8 byte sequences before hexadecimal conversion. For instance, the accented letter "é" occupies two bytes in UTF-8 (hex C3 and A9), translating deterministically into %C3%A9. Modern 4-byte pictorial emojis present even greater complexity: a standard emoji like the grinning face requires four contiguous bytes (F0 9F 98 80), generating the composite sequence %F0%9F%98%80. Our utility adheres strictly to this multi-byte conversion pipeline, eliminating the corrupted character displays ("mojibake") that routinely plague systems relying on legacy ASCII or ISO-8859-1 encoding routines.
Meticulous URL encoding is not merely a matter of visual correctness; it is a foundational defense mechanism against web application security exploits. When applications concatenate raw user input directly into query strings without rigorous escaping, they introduce severe attack vectors such as HTTP Parameter Pollution (HPP), open redirect exploits, and server-side request forgery (SSRF). Malicious actors can inject unescaped ampersands (&) or equal signs (=) to overwrite internal authentication flags or hijack state tokens. Our URL Encoder demonstrates the gold standard in parameter sanitization. Simultaneously, we enforce strict local privacy: all parsing and transformations execute 100% within your client browser memory sandbox. Sensitive query strings, API bearer tokens, and internal endpoints are never dispatched to remote servers, safeguarding corporate intellectual property.
Count words, characters, paragraphs, reading and speaking time in real time or directly from any website URL.
Convert text between different cases (UPPER, lower, Title).
Validate and beautify your JSON code.
Convert Markdown to clean HTML code (and vice versa) with live preview and download.