What is the difference between encodeURI and encodeURIComponent?

encodeURI leaves the reserved structural characters (: / ? # & =) intact and is meant for a complete URL. encodeURIComponent encodes them as well and is meant for a single parameter value. Use the component form whenever you are inserting a value into a URL.

Why does my encoded URL show %2520?

It was encoded twice: '%' became %25 on the second pass. Find the layer applying the extra encoding — usually a framework that encodes automatically on top of code that already did.

%20 under RFC 3986, which is correct everywhere in a URL. The '+' form is only valid inside an application/x-www-form-urlencoded query string or POST body. When in doubt, use %20.

Does encoding a URL make it safe?

No. Percent-encoding preserves structure; it is not validation or sanitisation. Check the scheme and host against an allowlist before redirecting a user to a URL you received as input.

URL & Links🔒 Browser (client-side)API available📴 Works offlinebeginner

URL Encoder

Percent-encodes (RFC 3986) or decodes query parameters, URI path segments, and form components for safe HTTP transport.

Data stays in your browser

Ready to runInstant execution

All tools →

Result

—

What does this tool do?

Percent-encodes (RFC 3986) or decodes query parameters, URI path segments, and form components for safe HTTP transport.

Why would I use it?

You have spaces or special characters in a URL parameter.
You are preparing values for query strings or path segments.
You want to decode a URL-encoded value.

Real-life example

Input

a b&c=d

Output

a%20b%26c%3Dd

Spaces become %20, & becomes %26.

Input → Process → Output → Next

Input: Type text, choose encode or decode.
Process: The browser applies encodeURIComponent/decodeURIComponent.
Output: The transformed string.
Next action: Use the encoded value in your URL.

Common mistakes

Encoding an entire URL (double-encoding the scheme and slashes).
Using encodeURI where encodeURIComponent is needed.
Decoding already-decoded data.

What the result means

Encoded text is safe inside URLs; decoded text is human-readable.

Privacy & security

Your input is processed entirely in your browser and never sent to a YAS server.

API

Endpoint

POST https://yas.sh/api/v1/tools/url-encoder

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/url-encoder" \
  -H "Content-Type: application/json" \
  -d '{"input":"a b&c=d","mode":"encode"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/url-encoder", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "input": "a b&c=d",
  "mode": "encode"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/url-encoder", json={"input":"a b&c=d","mode":"encode"})
data = r.json()

Field	Type	Required	Description
input	string	Yes	Text or URL fragment
mode	"encode" \| "decode"	No (default "encode")	Direction

Success response

{ "slug": "url-encoder", "result": "a%20b%26c%3Dd", "mode": "encode" }

Percent-encode / percent-decode a string.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How URL Encoder works

Percent-encoding replaces a byte with '%' followed by its two-digit hexadecimal value, as defined in RFC 3986. Characters are first encoded to UTF-8, so a space becomes %20 and 'é' becomes %C3%A9. Only unreserved characters — A–Z, a–z, 0–9, hyphen, period, underscore and tilde — are guaranteed to pass through unchanged.

The critical distinction is between encodeURI and encodeURIComponent. encodeURI preserves the reserved characters that give a URL its structure (: / ? # [ ] @ ! $ & ' ( ) * + , ; =) and is for encoding a whole URL. encodeURIComponent encodes those too and is for a single value going into a path segment or query parameter. Using the wrong one is why an encoded URL passed as a redirect parameter arrives truncated at the first ampersand.

Query strings add a historical quirk: application/x-www-form-urlencoded encodes a space as '+', while RFC 3986 percent-encoding uses %20. Both appear in the wild, and a decoder that does not know which convention produced the string will render '+' literally or turn a real plus sign into a space.

When to use it: real-world scenarios

Passing a URL as a query parameter

A return_to or redirect_uri value must be component-encoded, otherwise its own query string merges into the outer one. The symptom is a redirect that loses everything after the first '&'.

Building a search or share link

User-supplied text containing '#', '&' or '/' breaks an unencoded link. Encoding the value keeps the fragment and parameter boundaries intact regardless of what the user typed.

Reading an encoded URL from a log or referrer header

Decoding turns %3A%2F%2F back into :// so you can see the actual destination. Watch for double encoding, where %253A indicates the value was encoded twice along the way.

Handling non-ASCII domains and paths

Path segments with non-ASCII characters are UTF-8 percent-encoded, but the host label is not — internationalised domains use Punycode (xn--) instead, which is a separate transformation.

Pro tips

Encode values, not whole URLs, when building query strings. Better still, let URLSearchParams do it: it applies the correct rules and handles the '+' convention for you.
%25 is the encoding of '%' itself. Seeing %2520 in a URL means the value was encoded twice — fix the layer doing the second pass rather than decoding twice on receipt.
The fragment (#...) is never sent to the server. Encoding it affects only client-side routing.
Do not percent-encode the '=' and '&' that separate parameters, only the characters inside keys and values. Encoding the separators produces one parameter with a very strange name.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

The tool cannot know whether '+' in your input meant a space or a literal plus; that depends on the producer's convention.
Internationalised domain names require Punycode, not percent-encoding. Encoding a host label produces a URL that will not resolve.
Practical URL length limits (about 2,000 characters in some browsers and proxies) are reached faster once values are encoded, since one character can become nine bytes.
Encoding does not sanitise. A javascript: URL is still a javascript: URL after encoding; validate the scheme separately.

Frequently asked questions

What is the difference between encodeURI and encodeURIComponent?: encodeURI leaves the reserved structural characters (: / ? # & =) intact and is meant for a complete URL. encodeURIComponent encodes them as well and is meant for a single parameter value. Use the component form whenever you are inserting a value into a URL.
Why does my encoded URL show %2520?: It was encoded twice: '%' became %25 on the second pass. Find the layer applying the extra encoding — usually a framework that encodes automatically on top of code that already did.
Is a space %20 or +?: %20 under RFC 3986, which is correct everywhere in a URL. The '+' form is only valid inside an application/x-www-form-urlencoded query string or POST body. When in doubt, use %20.
Does encoding a URL make it safe?: No. Percent-encoding preserves structure; it is not validation or sanitisation. Check the scheme and host against an allowlist before redirecting a user to a URL you received as input.