URL Encoder / Decoder

What URL encoding does

URL encoding, also called percent encoding, converts characters that have special meaning in URLs into safe escape sequences. A space becomes %20, an ampersand becomes %26, and non-ASCII text is encoded as UTF-8 bytes. This is essential when building query strings, redirect URLs, callback parameters and form links.

Encode components, not whole URLs

The safest rule is to encode the value you are inserting into a URL, not the whole URL around it. Encoding an entire URL turns https://, slashes and question marks into escaped text, which is usually not what you want. In JavaScript terms, this tool behaves like encodeURIComponent and decodeURIComponent.

Practical examples

Original	Encoded
`hello world`	`hello%20world`
`a=b&c=d`	`a%3Db%26c%3Dd`
`email+tag@example.com`	`email%2Btag%40example.com`

Limits and safety

Encoding does not make an unsafe URL safe. A decoded redirect target can still be malicious, and an encoded script string is still dangerous if inserted into HTML without escaping. Treat URL encoding as syntax handling, not security by itself.

Browser-only processing

URL Encoder / Decoder runs as plain JavaScript inside this page using the browser's own Web Crypto and text APIs where the tool needs randomness or hashing. There is no request to our server when you press the tool buttons, so nothing you enter leaves your device through EmailGenerator.pro.

Privacy note

No input is sent anywhere by the tool. It operates entirely in your browser tab. You can verify this by opening the browser's network inspector and running the tool: execution does not create an outbound request.

Questions

Should spaces be plus signs or %20?

In query form encoding, spaces are often represented as plus signs. For general URL components, %20 is the clearer and safer representation.

Can URL encoding prevent XSS?

No. It can make text valid inside a URL component, but HTML, JavaScript and CSS contexts need their own escaping rules.