URL Encode

How to URL encode text

1. Type or paste the text into the left box. The encoded result appears on the right as you type.
2. Choose how to encode it under Encode as:
   • Component (encodeURIComponent) for a single query value, path segment or anything you put inside a URL. This is the default and the safe choice.
   • Full URL (encodeURI) to clean up a complete link with spaces or accents without breaking its ://, ? and &.
   • Form data (+ for spaces) for application/x-www-form-urlencoded bodies and query strings built like an HTML form.
3. Tick Each line separately to encode a list of values in one go.
4. Press Copy. To check the result, press Swap ⇄ or open the URL decoder.

encodeURI vs encodeURIComponent

Both percent-encode text as UTF-8; the difference is which characters they leave alone. encodeURI assumes you are giving it a whole URL, so it keeps the reserved characters that separate its parts. encodeURIComponent assumes you are giving it one value, so it encodes those too. Form encoding goes one step further and also encodes ! ' ( ) ~, with + for spaces. What each mode does to each character (computed by the encoder above, and identical to the browser's own functions):

Greyed-out cells are left as they are. The practical rule: build URLs from encoded pieces. Using encodeURI on a value is the most common bug, because it lets & and = through. Passing a return URL as a parameter:

• Correct, with encodeURIComponent: https://example.com/login?next=https%3A%2F%2Fexample.org%2Fcart%3Fid%3D42%26ref%3Dmail
• Broken, with encodeURI: https://example.com/login?next=https://example.org/cart?id=42&ref=mail. The server sees next=https://example.org/cart?id=42 and a separate ref=mail parameter.

URL encoding examples

Which characters need URL encoding?

RFC 3986 splits characters into three groups:

• Unreserved: A–Z a–z 0–9 - . _ ~. Always safe, never need encoding.
• Reserved: : / ? # [ ] @ and ! $ & ' ( ) * + , ; =. They have a job in URLs (separating the scheme, host, path, query and parameters), so encode them whenever they are part of your data.
• Everything else: spaces, " % < > \ ^ ` { | }, control characters and every non-ASCII character. These must always be encoded. Non-ASCII text is first converted to UTF-8, so one character can become up to four %XX codes.

Spaces: %20 or +?

%20 is the space in every part of a URL. + is a space only in the query string and in form bodies, a convention from HTML forms (application/x-www-form-urlencoded). That is why a literal plus sign in a query value must be sent as %2B: otherwise the server reads it as a space, a classic bug with phone numbers like +1 555 0100 and with Base64 values. When in doubt, use %20.

URL encode in JavaScript, Python, PHP, Java and C#

// JavaScript
encodeURIComponent("café & crème");                // "caf%C3%A9%20%26%20cr%C3%A8me"
new URLSearchParams({ q: "café au lait" }).toString(); // "q=caf%C3%A9+au+lait"

# Python
from urllib.parse import quote, quote_plus, urlencode
quote("café & crème", safe="")                     # %20 for spaces
urlencode({"q": "café au lait"})                     # + for spaces

// PHP: rawurlencode() uses %20, urlencode() uses +
rawurlencode("café & crème");

// Java (form style, + for spaces)
URLEncoder.encode("café & crème", StandardCharsets.UTF_8);

// C#
Uri.EscapeDataString("café & crème");              // %20 for spaces

Related developer tools

• URL decoder: decode %XX codes and see every query parameter of a link.
• Base64 encoder: for binary data or files you need to put in a URL or JSON.
• JWT decoder: read the URL-safe Base64 parts of a JSON Web Token.

Frequently asked questions