URL Encode Decode Tool
Encode special characters for URLs or decode percent-encoded URL strings. Enter values for instant results with step-by-step formulas.
Calculator
Adjust values & calculateFormula
URL encoding converts each unsafe character to its UTF-8 byte representation, then represents each byte as a percent sign followed by two hexadecimal digits. For example, a space (byte 0x20) becomes %20, and a multi-byte Unicode character produces multiple %XX sequences.
Last reviewed: December 2025
Worked Examples
Example 1: Encoding a URL with Query Parameters
Example 2: Decoding a Complex Percent-Encoded URL
Background & Theory
The URL Encode Decode Tool applies the following established principles and formulas. Computers represent all information using binary, a base-2 number system consisting solely of the digits 0 and 1, each called a bit. Because long binary strings are unwieldy, programmers routinely use octal (base 8) and hexadecimal (base 16) as compact shorthand. Converting between bases follows a consistent algorithm: divide the source number repeatedly by the target base, collecting remainders in reverse order. Hexadecimal digits A through F represent the values 10 through 15, allowing a single character to encode four binary bits, making it the preferred notation for memory addresses, color codes, and bytecode. Bitwise operations manipulate individual bits within integers. AND produces a 1 only when both input bits are 1, making it useful for masking. OR produces a 1 when either bit is 1 and is used for combining flags. XOR flips bits that differ, enabling simple toggle logic and efficient swap algorithms. NOT inverts every bit (one's complement), while left and right shifts multiply or divide by powers of two in constant time. Data storage units ascend in binary multiples of 1024: 8 bits form one byte, 1024 bytes form one kibibyte (KiB), 1024 KiB form one mebibyte (MiB), and so forth. Hard-drive manufacturers historically use decimal prefixes (1 KB = 1000 bytes), creating the persistent confusion between binary and decimal interpretations of the same label. The IEC standardized the binary prefixes KiB, MiB, GiB, and TiB in 1998 to resolve this ambiguity. Network bandwidth is measured in bits per second (bps), most commonly megabits per second (Mbps) or gigabits per second (Gbps). A 100 Mbps connection transfers 100 million bits every second, equating to roughly 12.5 megabytes per second. IP subnet masks define network boundaries; CIDR notation appends a prefix length (e.g., /24) to an address, indicating how many leading bits are fixed. A /24 subnet contains 256 addresses with 254 usable hosts. Algorithm efficiency is described using Big-O notation, which characterises the worst-case growth of time or space relative to input size. O(1) is constant, O(log n) is logarithmic (binary search), O(n) is linear, and O(n²) is quadratic. Cryptographic hash functions like SHA-256 produce a fixed 256-bit (32-byte) digest regardless of input length. File compression algorithms exploit statistical redundancy to reduce storage footprint, and compression ratio equals the original file size divided by the compressed size.
History
The history behind the URL Encode Decode Tool traces back through the following developments. The conceptual foundation of modern computing traces back to Charles Babbage, whose Analytical Engine design of 1837 introduced the idea of a general-purpose mechanical computer with separate storage and processing units, including what he called the Store and the Mill. Ada Lovelace wrote what many consider the first algorithm intended for machine execution while annotating a translation of Luigi Menabrea's account of Babbage's work, also recognising the machine's potential to manipulate symbols beyond mere numbers. George Boole published "The Laws of Thought" in 1854, formalising a two-valued algebra of logic that would later map perfectly to electrical circuits. It remained largely a mathematical curiosity until Claude Shannon's landmark 1937 master's thesis demonstrated that Boolean algebra could describe switching circuits, laying the theoretical groundwork for all digital electronics. Shannon's 1948 paper "A Mathematical Theory of Communication" defined the bit as the fundamental unit of information and established information theory as a rigorous discipline. The same year, the transistor was invented at Bell Labs by Bardeen, Brattain, and Shockley, eventually replacing vacuum tubes and enabling miniaturisation at scale. ENIAC, completed in 1945, was one of the first general-purpose electronic computers, occupying 1800 square feet and consuming 150 kilowatts of power while performing roughly 5000 additions per second. The ASCII standard was ratified in 1963, assigning 7-bit codes to 128 characters and enabling interoperability between computers from different manufacturers. Through the 1970s, the microprocessor consolidated an entire CPU onto a single chip; Intel's 4004 in 1971 marked the beginning of this trend. The Apple II launched in 1977 and the IBM PC in 1981 brought computing to homes and offices, triggering a mass-market software industry. Tim Berners-Lee proposed the World Wide Web in 1989 and launched the first website in 1991 at CERN, transforming the internet from an academic and military network into a global information infrastructure. Mobile computing accelerated through the 2000s with smartphones integrating powerful processors, wireless networking, and GPS into pocket-sized devices, extending computation into every facet of daily life and cementing TCP/IP as the universal communications fabric.
Frequently Asked Questions
Formula
Character -> UTF-8 bytes -> %XX per byte
URL encoding converts each unsafe character to its UTF-8 byte representation, then represents each byte as a percent sign followed by two hexadecimal digits. For example, a space (byte 0x20) becomes %20, and a multi-byte Unicode character produces multiple %XX sequences.
Worked Examples
Example 1: Encoding a URL with Query Parameters
Problem: Encode the URL: https://example.com/search?q=hello world&category=books & media
Solution: Using encodeURI (preserve URL structure):\nhttps://example.com/search?q=hello%20world&category=books%20&%20media\nNote: & is preserved as URL delimiter\n\nUsing encodeURIComponent (for parameter values only):\nq = hello%20world\ncategory = books%20%26%20media\nNote: & in 'books & media' is encoded to %26\n\nFull reconstructed URL:\nhttps://example.com/search?q=hello%20world&category=books%20%26%20media
Result: Space -> %20 | & in value -> %26 | URL structure preserved correctly
Example 2: Decoding a Complex Percent-Encoded URL
Problem: Decode: https://api.example.com/v2/users?name=Fran%C3%A7ois%20M%C3%BCller&city=Z%C3%BCrich
Solution: Percent-encoded sequences:\n%C3%A7 -> UTF-8 bytes C3 A7 -> Unicode U+00E7 -> character: c with cedilla\n%20 -> space\n%C3%BC -> UTF-8 bytes C3 BC -> Unicode U+00FC -> character: u with umlaut\n\nDecoded parameters:\nname = Francois Muller (with proper diacritics)\ncity = Zurich (with u-umlaut)\n\nFull decoded URL:\nhttps://api.example.com/v2/users?name=Francois Muller&city=Zurich
Result: Decoded: name=Francois Muller, city=Zurich | 3 Unicode chars decoded
Frequently Asked Questions
What is URL encoding and why is it necessary?
URL encoding, also called percent-encoding, is the process of converting characters that are not allowed or have special meaning in URLs into a safe format using percent signs followed by hexadecimal values. URLs can only contain a limited set of characters from the ASCII character set, and certain characters like spaces, ampersands, question marks, and hash symbols have reserved meanings as delimiters within the URL structure. Without encoding, a search query containing an ampersand would be misinterpreted as a parameter separator, breaking the URL parsing. For example, a space becomes %20, an ampersand becomes %26, and a question mark becomes %3F. This ensures that user input and data values are transmitted correctly without interfering with the URL structure itself.
What are common mistakes when working with URL encoding?
The most frequent mistake is double-encoding, where an already-encoded string gets encoded again, turning %20 into %2520 (the percent sign itself gets encoded). This happens when code applies encoding without checking if the string is already encoded. Another common error is using encodeURI when encodeURIComponent is needed, which fails to encode ampersands and equals signs in query values, breaking parameter parsing. Forgetting to encode plus signs in query strings is problematic because HTML forms encode spaces as plus signs per the application/x-www-form-urlencoded specification, but this is different from standard percent-encoding where spaces are %20. Developers also frequently forget to decode URL parameters on the server side, storing encoded data in databases. Using manual string replacement instead of proper encoding functions leads to missed edge cases.
How do different programming languages handle URL encoding?
Each programming language provides its own URL encoding functions with subtle differences. JavaScript offers encodeURIComponent for component encoding and encodeURI for full URLs. Python has urllib.parse.quote for percent-encoding and urllib.parse.urlencode for form data encoding. PHP provides urlencode (which encodes spaces as plus signs) and rawurlencode (which uses %20 for spaces per RFC 3986). Java offers URLEncoder.encode which follows form encoding conventions with spaces as plus signs. Ruby uses ERB::Util.url_encode and CGI.escape with different behaviors for reserved characters. These differences can cause interoperability issues when systems written in different languages communicate, making it important to explicitly choose between RFC 3986 percent-encoding and form-data encoding based on your specific use case.
Can URL encoding cause security vulnerabilities?
Yes, improper URL encoding and decoding is the root cause of several web security vulnerabilities. Path traversal attacks use encoded sequences like %2e%2e%2f (which decodes to ../) to escape intended directory structures and access unauthorized files on the server. Double encoding attacks exploit applications that decode URLs multiple times, where %252e%252e%252f first decodes to %2e%2e%2f and then to ../, bypassing security filters that only check for the decoded form. Cross-site scripting (XSS) attacks can use URL encoding to smuggle malicious JavaScript through input validation that does not properly decode before checking. SQL injection payloads can be URL-encoded to bypass web application firewalls. The defense involves properly decoding all input before validation, using parameterized queries, and implementing allowlist-based input validation rather than blocklist approaches.
What is the maximum length of a URL and how does encoding affect it?
While the HTTP specification does not define a maximum URL length, practical limits exist across browsers and servers. Internet Explorer historically limited URLs to 2,083 characters, and while modern browsers support much longer URLs (Chrome and Firefox handle over 60,000 characters), many web servers and proxies enforce limits between 2,048 and 8,192 characters. URL encoding significantly impacts effective URL length because each encoded character expands from 1 character to 3 characters (%XX format), and multi-byte Unicode characters can expand to 9 or more characters. A Chinese character that is 3 UTF-8 bytes becomes 9 characters when percent-encoded (%E4%B8%AD). This means a query string with internationalized content can quickly exceed URL length limits. For large data payloads, POST requests with the data in the request body are preferred over GET requests with encoded query parameters.
Can I use URL Encode Decode Tool on a mobile device?
Yes. All calculators on NovaCalculator are fully responsive and work on smartphones, tablets, and desktops. The layout adapts automatically to your screen size.
References
Reviewed by Daniel Agrici, Founder & Lead Developer · Editorial policy