Koder / Dekoder URL

Novo

Kodirajte ali dekodirajte besedilo s procentnim kodiranjem in razčlenite poizvedbene nize v vašem brskalniku.

Rules

Text to encode

Encoded result

Special characters reference

Character	Encoded (%XX)	Notes
space	%20	Also encoded as + in HTML form query strings
&	%26	Query param separator — encode in values
=	%3D	Key-value separator in query strings
?	%3F	Marks the start of a query string
#	%23	Fragment identifier
/	%2F	Path separator
:	%3A	Protocol / port separator
@	%40	Username delimiter in URLs
+	%2B	Literal plus sign (+ in query string = space)
%	%25	Percent itself — encode to avoid ambiguity
€	%E2%82%AC	UTF-8 multi-byte (3 bytes)
©	%C2%A9	UTF-8 multi-byte (2 bytes)

Per-language code snippets

Copy-ready snippets for JavaScript, Python, C#, PowerShell, Java and Go.

JavaScript / Node.js

// Encode a single query value (recommended)
const encoded = encodeURIComponent('hello world & co.');
// → 'hello%20world%20%26%20co.'

// Decode
const decoded = decodeURIComponent('hello%20world%20%26%20co.');
// → 'hello world & co.'

// Encode a full URL (leaves : / ? & # intact)
const safeUrl = encodeURI('https://example.com/search?q=hello world');
// → 'https://example.com/search?q=hello%20world'

Python

from urllib.parse import quote, unquote, urlencode

# Encode a single value (%20 for spaces)
encoded = quote('hello world & co.')
# → 'hello%20world%20%26%20co.'

# Decode
decoded = unquote('hello%20world%20%26%20co.')
# → 'hello world & co.'

# Encode a query dict (uses + for spaces — form encoding)
qs = urlencode({'q': 'hello world', 'page': '2'})
# → 'q=hello+world&page=2'

# quote_plus encodes spaces as + (match HTML form encoding)
plus = quote_plus('hello world')
# → 'hello+world'

C# / .NET

// Encode a single value (spaces → %20)
string encoded = Uri.EscapeDataString("hello world & co.");
// → "hello%20world%20%26%20co."

// Decode
string decoded = Uri.UnescapeDataString("hello%20world%20%26%20co.");
// → "hello world & co."

// Older System.Web API (spaces → +, form encoding):
// HttpUtility.UrlEncode("hello world") → "hello+world"

PowerShell

# .NET method — works in PS 5+ and PowerShell Core
$encoded = [Uri]::EscapeDataString('hello world & co.')
# → 'hello%20world%20%26%20co.'

$decoded = [Uri]::UnescapeDataString('hello%20world%20%26%20co.')
# → 'hello world & co.'

# Alternate via System.Web (Desktop PS only):
Add-Type -AssemblyName System.Web
$enc2 = [System.Web.HttpUtility]::UrlEncode('hello world')
# → 'hello+world'

Java

import java.net.URLEncoder;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;

// Encode (URLEncoder uses + for spaces — form encoding)
String encoded = URLEncoder.encode("hello world & co.", StandardCharsets.UTF_8);
// → "hello+world+%26+co."

// Decode
String decoded = URLDecoder.decode("hello+world+%26+co.", StandardCharsets.UTF_8);
// → "hello world & co."

import "net/url"

// QueryEscape: spaces become +
encoded := url.QueryEscape("hello world & co.")
// → "hello+world+%26+co."

decoded, err := url.QueryUnescape("hello+world+%26+co.")
// → "hello world & co.", nil

// PathEscape: spaces become %20
pathSafe := url.PathEscape("hello world & co.")
// → "hello%20world%20&%20co."

Runs entirely in your browser. Nothing is uploaded.

Free online URL encoder and decoder

This URL encoder and decoder converts text to percent-encoded form — or reverses the process — right in your browser. Paste your text, choose Encode or Decode, pick Component or Full URI rules, and the result updates live. Nothing is uploaded; every operation runs entirely in your browser using the same built-in JavaScript functions your code uses.

Percent-encoding is unavoidable in web development. Spaces, ampersands, equals signs and non-ASCII characters all have to be escaped before they can live safely in a URL. Whether you're constructing an API request, debugging a tracking link, or reading a server log, this tool handles all the edge cases — including multi-byte UTF-8 characters, malformed sequences and the + vs %20 space ambiguity.

encodeURIComponent vs encodeURI — which rule to use?

encodeURIComponent is the right choice for individual query values, path segments or any string you're inserting into a URL. It encodes nearly every special character — including ?, &, =, /, # and : — so the value can't break the URL structure. Example: 'hello world & page=2' becomes 'hello%20world%20%26%20page%3D2'.

encodeURI is designed for encoding a complete URL without breaking it. It leaves structural characters intact (: / ? # &) so the URL keeps working while still encoding spaces and non-ASCII characters. If in doubt, prefer Component rules for anything you're inserting as a value — that's the safe default in nearly every web framework.

Spaces as %20 vs + — the form-encoding distinction

There are two valid ways to encode a space in a URL. In URL paths (the part before ?), RFC 3986 requires %20. In HTML form query strings, the older application/x-www-form-urlencoded format encodes spaces as + for historical compactness — and that's still what browsers send when you submit a form via GET.

Both mean 'space', but only in their own context. A + in a URL path is a literal plus sign; a + in a query string is a space. A literal plus in a query value must be encoded as %2B or it'll be misread. The Decode mode's + as space toggle handles form-encoded input by replacing + with a space before running decodeURIComponent — useful when inspecting form submissions or OAuth tokens.

How this compares to CyberChef and other URL encoding tools

CyberChef (from GCHQ) is powerful but designed around a 'recipe' pipeline concept — you chain multiple operations together. For pure URL encoding or decoding, you still have to search for the operation, drag it into the recipe, then process input. It's excellent for complex transformations; it's slower than necessary for a quick encode/decode.

Other online tools like urldecoder.org and meyerweb.com/eric/tools/dencoder/ are simple but show ads, require full-page reloads on each operation, and don't offer per-language code snippets. This tool updates the result instantly on every keystroke, handles both Component and Full URI rules, includes a reference table of common encoded characters, and shows copy-ready code in JavaScript, Python, C#, PowerShell, Java and Go — all without uploading anything.

Special characters quick reference

The most commonly encoded characters in web development: space → %20 (or + in query strings), & → %26, = → %3D, ? → %3F, # → %23, / → %2F, : → %3A, @ → %40, + → %2B, % → %25. Multi-byte UTF-8 characters expand into multiple sequences: € → %E2%82%AC, é → %C3%A9.

The characters that are never encoded are the unreserved set: letters A–Z and a–z, digits 0–9, and the four symbols - _ . ~. Everything else — including every non-ASCII character — must be percent-encoded in a standards-compliant URL.

URL encoding in JavaScript, Python, C#, PowerShell and Java

Every major language has a built-in function for this. In JavaScript / Node.js: encodeURIComponent(str) and decodeURIComponent(str) — no imports needed. In Python: urllib.parse.quote(str) and unquote(str); urlencode(dict) for a full query string. In C#: Uri.EscapeDataString(str) and Uri.UnescapeDataString(str) from the System namespace. In PowerShell: [Uri]::EscapeDataString(str), available in PS 5+ and PowerShell Core. In Java: URLEncoder.encode(str, StandardCharsets.UTF_8).

The per-language snippets panel includes copy-ready code for JavaScript, Python, C#, PowerShell, Java and Go so you can drop the right call into your project immediately — with notes on the + vs %20 space behavior for each language's standard library.

100% private — works offline too

Every encode and decode operation uses only your browser's built-in encodeURIComponent, decodeURIComponent, encodeURI and decodeURI functions. No text is ever sent to a server, stored or logged — not even the domain names in URLs you paste. Once the page is loaded, take the device offline and it continues to work perfectly. Bookmark it and reach for it any time you need to encode, decode or inspect a URL.

RFC 3986: the anatomy of a URL and its character rules

RFC 3986 — the definitive IETF specification for Uniform Resource Identifiers — defines a URL as a sequence of components: scheme://userinfo@host:port/path?query#fragment. Each component is parsed independently, and each has its own set of characters that carry syntactic meaning. A colon after the scheme (https:) is a delimiter; a colon inside a path segment is just data. Because the same byte can mean different things depending on where it appears, the spec draws a hard line between characters that belong in the syntax and characters that must be escaped.

The spec defines two classes of characters. Unreserved characters — the 66 code points A–Z, a–z, 0–9, hyphen, underscore, dot and tilde — are safe everywhere in a URL and must never be percent-encoded; encoding them produces a technically different but equivalent URL. Reserved characters — the 18 code points : / ? # [ ] @ ! $ & ' ( ) * + , ; = — carry syntactic meaning and must be percent-encoded when they appear as data rather than delimiters. A # in a query value, for instance, would be read as the start of the fragment, silently discarding everything after it.

Understanding this boundary matters in practice. If you place a raw & inside a query parameter value, a parser will split it into two parameters at that point. A raw / inside a path segment looks like a directory boundary. A raw ? inside a path looks like the start of the query string. Every reserved character that appears as data must be encoded — that is the entire purpose of percent-encoding, and it is why blindly copying a URL from a document and dropping it into code so frequently produces silent bugs.

Percent-encoding mechanics: %XX, UTF-8 bytes and multi-byte sequences

Percent-encoding works at the byte level, not the character level. Each unsafe byte is written as a percent sign followed by exactly two uppercase hexadecimal digits representing that byte's value. Common single-byte examples: a space (byte 0x20) becomes %20, a plus sign (0x2B) becomes %2B, an at-sign (0x40) becomes %40, a hash (0x23) becomes %23, a forward slash (0x2F) becomes %2F. Because ASCII characters are all single bytes, each one produces exactly one %XX token.

Non-ASCII characters require UTF-8 encoding first, then percent-encoding of each resulting byte. The accented letter é is Unicode code point U+00E9. In UTF-8 it encodes as two bytes: 0xC3 and 0xA9, so the percent-encoded form is %C3%A9. The Chinese character 中 (U+4E2D) encodes to three UTF-8 bytes 0xE4 0xB8 0xAD, producing %E4%B8%AD. An emoji like 😀 (U+1F600) needs four UTF-8 bytes and expands to %F0%9F%98%80. This is why you should never assume a %XX sequence decodes to a single character — scan for groups of consecutive sequences and decode them together as a UTF-8 sequence.

The difference between JavaScript's two encoding functions comes directly from the RFC 3986 character classes. encodeURIComponent() encodes every character except the 66 unreserved characters, making it safe for any value you insert into a URL — query parameter value, path segment, hash value. encodeURI() additionally preserves the 18 reserved characters plus # so the overall URL structure survives encoding; use it only when you have a complete URL you want to encode lightly, not individual values. Mixing them up — encoding a full URL with encodeURIComponent — will destroy all slashes, colons and question marks.

Common URL encoding bugs: double-encoding, + confusion and non-breaking spaces

Double-encoding is the most frequent encoding bug in production systems. It happens when an already-encoded string is encoded a second time. A space encodes to %20; encoding %20 a second time turns the % into %25, producing %2520. When the server decodes it once it gets the string %20, not a space. To represent a literal percent sign in a URL you must encode it as %25 — that is correct and intentional — but if your pipeline encodes values at two layers (once in the ORM, once in the HTTP client) you will silently corrupt data. The fix is to ensure encoding happens at exactly one layer, closest to where the URL is assembled.

The plus-sign ambiguity is a second recurring source of bugs. Web servers decode + as a space in query strings because HTML's application/x-www-form-urlencoded format uses that convention — but they do not decode + as a space in path segments, where a + is always a literal plus. If you encode a path segment with Python's quote_plus() or JavaScript's form-data APIs (which use the form-encoding convention), spaces become + and a server will serve a 404 for what should be a valid path. Always use %20 in path segments and reserve + only for application/x-www-form-urlencoded query strings. A corollary: a literal + in a query value must become %2B or it will be decoded as a space.

Two subtler issues round out the common pitfalls. First, hex case: RFC 3986 says percent-encoded triplets are case-insensitive, so %2F and %2f are equivalent — but some legacy APIs or signature-verification schemes do a byte-level string comparison and reject lowercase hex. Always emit uppercase hex (JavaScript's built-in functions do this; Python's urllib.parse.quote does too). Second, the non-breaking space (Unicode U+00A0) is not the same as a regular space (U+0020). A regular space encodes to %20; a non-breaking space, encoded in UTF-8 as bytes 0xC2 0xA0, encodes to %C2%A0. Copy-pasting text from word-processing software or rich-text editors frequently introduces non-breaking spaces that look identical on screen but produce entirely different percent-encoded strings, causing string comparisons and cache lookups to fail.

International domain names, Punycode and the IDN homograph threat

While percent-encoding handles the path, query and fragment portions of a URL, the host (domain name) portion uses a completely different encoding scheme called Punycode. DNS was designed for ASCII, so non-ASCII domain names — called Internationalized Domain Names (IDNs) — are converted to an ASCII-compatible encoding before being looked up in DNS. The algorithm produces labels prefixed with xn--: the German domain münchen.de becomes xn--mnchen-3ya.de; the Japanese 東京.jp becomes xn--wgv71a309e.jp. The conversion is defined in RFC 3492 and is handled transparently by browsers and operating systems — users type the native-script name and the browser translates it before making the DNS request.

IDNs introduce a significant security vulnerability known as the IDN homograph attack. Many Unicode characters are visually indistinguishable from ASCII letters: Cyrillic а (U+0430) looks identical to Latin a (U+0061); Greek ο (U+03BF) looks identical to Latin o. An attacker can register a domain like pаypal.com where the а is Cyrillic, create a convincing phishing site, and the URL in the browser bar looks authentic to a casual observer. To defend against this, browsers apply heuristics: if a domain mixes scripts (Latin and Cyrillic in the same label) or belongs to a TLD that has not published a safe-character policy, the browser displays the Punycode form (xn--pypal-4ve.com) rather than the native script, making the substitution visible. Single-script domains from registered TLDs that have opted into IDN are shown in their native script.

The practical takeaway for developers is that the host and path encode differently and must never be conflated. Do not percent-encode a domain name — that would produce garbage DNS queries. Do not apply Punycode to a path — paths use percent-encoding exclusively. When constructing a URL programmatically from user-supplied input, use a URL-parsing library (the WHATWG URL constructor in JavaScript, Python's urllib.parse.urlsplit, etc.) rather than string concatenation. These libraries apply the correct encoding to each component automatically and protect against both malformed output and injection attacks.

Frequently asked questions

What is URL encoding?

URL encoding (also called percent-encoding) converts characters that aren't safe in a URL into a % sign followed by two hexadecimal digits. For example, a space becomes %20, an ampersand becomes %26 and a hash becomes %23. It ensures every URL is valid across any browser, HTTP header or server regardless of the character set. Without it, URLs containing spaces or special characters would break or be misinterpreted by servers.

What does %20 mean in URL encoding?

%20 is the percent-encoded representation of a space character. The 20 is the hexadecimal value of ASCII 32 (the space). So the URL 'hello%20world' decodes back to 'hello world'. In HTML form query strings you'll sometimes see + instead of %20 for spaces — the two mean the same thing in query strings but not in URL paths.

What does URL-encoded do?

URL encoding makes arbitrary text safe to include in a URL by replacing unsafe characters with their %XX escape sequences. Without it, characters like spaces, ampersands, equals signs and non-ASCII letters would break URL parsing. Decoding reverses the process, turning %XX sequences back into their original characters — useful for reading tracking links, API responses and log files.

How do I URL-encode a string?

Paste your text into the input box above, select Encode mode and choose Component rules. The encoded version appears instantly. For example, 'hello world & co.' becomes 'hello%20world%20%26%20co.' — every space and special character is replaced with its %XX sequence. No account needed, no upload — the tool encodes using your browser's built-in functions.

How do I URL-decode a string?

Switch the mode toggle to Decode, paste your percent-encoded text, and the plain text appears immediately. For example, 'caf%C3%A9%3F' decodes to 'café?'. If the input contains a malformed sequence (like a stray % not followed by two hex digits) the tool reports the exact error so you can locate and fix it.

What's the difference between encodeURI and encodeURIComponent?

encodeURIComponent is for individual query values or path segments — it encodes almost everything including : / ? # & = so the value can't break the URL structure. Example: 'hello world & page=2' → 'hello%20world%20%26%20page%3D2'. encodeURI is for a complete URL — it leaves structural characters like : / ? & # intact so the URL keeps working. As a rule, always use encodeURIComponent for individual values you're inserting into a link.

What is percent-encoding?

Percent-encoding is the formal RFC 3986 name for URL encoding. Each unsafe byte is written as a % followed by exactly two uppercase hex digits. Multi-byte UTF-8 characters expand into multiple %XX sequences: the euro sign '€' becomes %E2%82%AC, an accented 'é' becomes %C3%A9. The spec defines a set of 'unreserved' characters (A–Z, a–z, 0–9, -, _, ., ~) that are never encoded.

Which characters need encoding in a URL?

Any character outside the unreserved set (A–Z, a–z, 0–9, hyphen, underscore, dot, tilde) must be percent-encoded in most URL contexts. The most common ones: space → %20, & → %26, = → %3D, ? → %3F, # → %23, / → %2F, : → %3A, @ → %40, + → %2B, % → %25. Non-ASCII characters (accents, emoji) encode as multiple %XX sequences via UTF-8.

Why is a space %20 sometimes and + other times?

In URL paths (before the ?), spaces must be %20 per RFC 3986. In query strings, the older application/x-www-form-urlencoded format used by HTML forms encodes spaces as + for historical brevity. Both mean 'space' but only in their own context — a literal + in a query value must be encoded as %2B or it'll be misread as a space. This tool's + as space toggle handles form-encoded input during decode.

What is %25 in URL encoding?

%25 is the percent-encoded form of a literal % character (ASCII 37 = hex 25). If you need a real percent sign in a URL — say, in a search query for '100%' — you must encode it as %25 so the parser doesn't treat it as the start of a percent-encoded sequence. The string '100%' encoded as a query value becomes '100%25'.

How do I URL-encode in JavaScript?

Use encodeURIComponent() for individual values: encodeURIComponent('hello world & co.') returns 'hello%20world%20%26%20co.'. Reverse it with decodeURIComponent(). For an entire URL use encodeURI() / decodeURI() — they skip structural characters. Both are built into every browser and Node.js with no imports needed.

How do I URL-encode in Python?

Use urllib.parse.quote() for a single value: from urllib.parse import quote; quote('hello world & co.') → 'hello%20world%20%26%20co.'. To decode: unquote('hello%20world%20%26%20co.'). For a full query string dict: urlencode({'q': 'hello world', 'page': '2'}) → 'q=hello+world&page=2'. quote_plus() uses + for spaces to match HTML form encoding.

How does this compare to CyberChef for URL encoding?

CyberChef is a fantastic multi-purpose tool from GCHQ, but it's built for complex data transformation pipelines — loading it just to encode a URL string means navigating its 'recipe' interface, which can feel like overkill. This tool is focused: paste your text, pick Encode or Decode, get the result instantly. No recipes, no menus. CyberChef requires more clicks to get to URL encoding specifically; this tool opens directly to it.

Is it safe to encode/decode online?

Yes — this tool is 100% local. Every encode and decode operation runs in your browser using built-in JavaScript functions (encodeURIComponent, decodeURIComponent, encodeURI, decodeURI). Your text is never sent to any server, stored or logged. You can even go offline after loading the page and it continues to work. This is especially important when encoding API keys, credentials or tokens.

Does it work offline?

Yes. All logic runs in your browser with zero network requests. Once the page has loaded you can disable Wi-Fi or mobile data and it keeps working perfectly — handy for encoding sensitive API keys or credentials without any text ever leaving your device.

Iskljivi priročnik žetonov in zastavic regularnih izrazov.

Razvijalci