URL Encoder & HTML Entity Encoder
Percent-encode a full URL or a single value, decode one back, or escape and unescape HTML entities. Both directions, live, with the exact function named so the result is predictable.
Type in either box: the other updates. Both directions run in your browser with the standard functions.
How to use it
- Pick the mode: URL (whole address), URL component (one value), or HTML entities.
- Paste text in either box. Encoding and decoding both run live as you type.
- Copy the result. For form values, tick form encoding to use + for spaces.
Three encodings that look alike and are not
Percent-encoding makes text safe to carry inside a URL: a space becomes %20, an ampersand %26, a Unicode character the UTF-8 bytes in hex. The catch is scope. Encode a whole URL with the component function and its slashes and question mark are escaped too, leaving an address that no longer resolves; encode a query value with the whole-URL function and an ampersand in the value silently splits the query into two parameters.
HTML entities solve a different problem: writing characters that HTML itself uses, such as less-than and ampersand, inside content without the parser reading them as markup. The encoder names which function runs in each mode, so the output matches what your code will do.
Encoding FAQ
What is the difference between encoding a URL and a component?
Encoding a whole URL (encodeURI) leaves the characters that give a URL its structure alone: / ? & = # : and so on, so https://example.com/a b?x=1 becomes https://example.com/a%20b?x=1 and still works as an address. Encoding a component (encodeURIComponent) escapes those too, which is what you want for a single value inside a query string: a value containing & or = would otherwise split the query.
Why does my decoded text show a plus sign instead of a space?
Form submissions (application/x-www-form-urlencoded) encode spaces as + rather than %20. Standard URL decoding leaves the + alone. Tick "form encoding" and the decoder turns + back into spaces, and the encoder produces + for spaces.
Which characters should be HTML entities?
Five are required in content and attributes: & as &, < as <, > as >, " as " and ' as '. Everything else, including accented letters and symbols, can be written as plain UTF-8 text on any modern page; the named entities for them (é, ©) are optional. The "named entities for all" option exists for legacy templates that need ASCII-only source.
Is this safe to use on secrets or private data?
The encoding runs inside your browser with the built-in JavaScript functions; the page makes no request with your text. Still, treat the browser as you would any other screen: do not paste secrets into shared computers.
The decoder says "malformed". What is wrong?
A % that is not followed by two hex digits, or a percent sequence that does not form valid UTF-8. Usually the text was already decoded once, or was cut in the middle of a sequence. Decoding a URL twice is a common cause: %2520 decodes to %20, and decoding again gives a space.
More free tools: Base64 Encoder · UTM Link Builder · Slug Generator · JSON Formatter