URL Encoder/Decoder

Both functions turn each character outside a small safe set into its UTF-8 bytes, written as % plus two hex digits. They differ in what they leave alone:

• encodeURIComponent keeps only A–Z a–z 0–9 - _ . ! ~ * ' ( ). Use it for anything you put inside a URL: a query value, a path segment, a form field. Characters such as &, =, ?, / and # are encoded, so they cannot break the URL apart.
• encodeURI also keeps ; , / ? : @ & = + $ #, so a complete URL still works after encoding. Never use it for a single value: Tom & Jerry would leave the & in place and split your query string.

A Chinese character takes three UTF-8 bytes, so it becomes nine characters of encoded text; an accented Latin letter takes two bytes. Readable ASCII slugs avoid this; see how to transliterate slugs.

In a URL path and with encodeURIComponent, a space is %20. HTML forms send data as application/x-www-form-urlencoded, where a space is written as + and a real plus sign as %2B: a b+c becomes a+b%2Bc. Turn on "Spaces as +" to encode or decode form data. Without it, the decoder leaves + as a plus sign, exactly like decodeURIComponent.

decodeURIComponent throws a URIError on two kinds of input, and this tool reports the exact position instead:

• A % without two hex digits. 100% or %zz is not a valid escape. If the text means a literal percent sign, it should have been encoded as %25.
• Bytes that are not UTF-8. %E4%B8 is a Chinese character cut short (it needs three bytes), and caf%E9 was encoded as Latin-1 rather than UTF-8. Re-encode the original text as UTF-8, or fix the truncated part.

With "Each line separately" on, a failing line is kept unchanged and every other line is still decoded.

Encoding an already-encoded string turns each % into %25: é becomes %C3%A9, and encoding again gives %25C3%25A9. It usually happens when a value is encoded once by your code and again by a library or CMS. The tool warns when you encode text that already contains escapes, and when decoded text still looks encoded it offers "Decode fully", which repeats the decode until nothing changes: caf%25C3%25A9 → caf%C3%A9 → café.

These functions give exactly the tool's output (checked against it for every test string):

// Query values, path segments, form fields: encode everything except A-Z a-z 0-9 - _ . ! ~ * ' ( )
encodeURIComponent('Café & Bar?');   // 'Caf%C3%A9%20%26%20Bar%3F'
decodeURIComponent('Caf%C3%A9');     // 'Café' (throws URIError on bad input such as '100%')

// A whole URL: keeps ; , / ? : @ & = + $ # so the URL still works
encodeURI('https://example.com/a b?q=café'); // 'https://example.com/a%20b?q=caf%C3%A9'

from urllib.parse import quote, unquote

def encode_uri_component(s):  # same output as JavaScript's encodeURIComponent
    return quote(s, safe="-_.!~*'()")

def encode_uri(s):  # same output as JavaScript's encodeURI
    return quote(s, safe="-_.!~*'();,/?:@&=+$#")

def decode_uri_component(s):  # raises on invalid UTF-8 such as '%E9'; a stray '%' is kept as is
    return unquote(s, errors='strict')

<?php
// rawurlencode() also encodes ! * ' ( ); put them back to match encodeURIComponent exactly.
function encode_uri_component(string $s): string {
    return strtr(rawurlencode($s), ['%21' => '!', '%2A' => '*', '%27' => "'", '%28' => '(', '%29' => ')']);
}

function decode_uri_component(string $s): string {
    return rawurldecode($s); // keeps "+" as "+"; use urldecode() for form data
}

For a URL slug you rarely need encoding at all: the URL slug generator turns titles into lowercase ASCII words joined by hyphens, which never need escaping. To strip accents from text without making a slug, use the remove accents tool.

• MDN: encodeURIComponent() and encodeURI()
• RFC 3986: Uniform Resource Identifier, section 2: Characters
• Python documentation: urllib.parse.quote()