CleanorTools
URL

URL Encode

Details

How to use URL Encode

What the tool does, how to run it, and what to expect from the result.

How to percent-encode a value for a URL

URLs allow only a restricted set of characters, and several of those characters carry meaning: the question mark starts a query, the ampersand separates parameters, the hash starts a fragment. Percent-encoding replaces anything that would be misread with a percent sign and two hex digits, so the value arrives at the server intact.

The rule that saves the most debugging time is to encode each value individually, before you assemble the URL. Encoding the finished string breaks the structural characters that hold it together.

  • Paste the single value you want to encode, such as a search term, a filename, or a callback URL.
  • Copy the percent-encoded output.
  • Insert it into the URL as a parameter value, for example ?q=your-encoded-value.
  • Repeat for each parameter separately, joining them with literal ampersands that you do not encode.
  • Test the finished URL, and check that a value containing an ampersand or an equals sign still arrives whole.
Tips

Getting a better result out of URL Encode

Specific settings and thresholds, not general advice.

  • This encodes a value, not a whole URL. It uses encodeURIComponent, which escapes the slash, colon, question mark, and ampersand, so feeding it a complete address turns https://example.com into https%3A%2F%2Fexample.com. That is correct when the URL is a query parameter value, and wrong when you wanted a working link.
  • Space becomes %20, never a plus sign. The plus-for-space convention belongs to HTML form submission (application/x-www-form-urlencoded), not to URLs in general. If you are hand-building a form body, %20 is still accepted by every server, but a plus is not accepted everywhere %20 is.
  • Eleven characters are deliberately left alone: A-Z, a-z, 0-9, minus, underscore, dot, exclamation mark, tilde, asterisk, apostrophe, and parentheses. Those last few are legal in URLs but often confuse link detectors in chat apps and email clients, so a URL ending in a parenthesis is a classic broken-link cause.
  • Encode each parameter value separately, then join them with ampersands. Encoding the assembled query string in one pass destroys the ampersands and equals signs that give it structure, and the server sees one giant parameter name.
  • The ampersand and equals sign are escaped for a reason. If a user's search term contains an ampersand and you do not encode it, everything after that character is read by the server as a new parameter, which is the entry point for parameter injection.
Limits

What URL Encode does not do

The honest boundary, so you do not lose time finding it yourself.

  • It does not encode a full URL correctly. It escapes the scheme separators, so use it on individual values (a query parameter, a path segment) rather than on a whole address.
  • It does not produce plus signs for spaces, so the output is not in the exact form some legacy form handlers expect.
  • It does not punycode internationalised domain names. A host such as cafe with an accent stays as literal characters rather than being converted to its xn-- form.
  • It does not know your destination's context, so it cannot tell you whether the value belonged in a path segment, a query value, or a fragment, each of which technically allows a different character set.
At a glance

Who URL Encode is for

A quick way to understand who this helps, what it solves, and where it connects next.

Best fit

Developers, engineers, and anyone working with encoded data.

Ideal for

Quick encoding, decoding, and inspection without a backend or install.

FAQ

Common questions

Short answers for the questions people usually have before trying a utility like this.

Is the URL encoder free?

Yes. It is completely free to use, with no signup, no account, and no paywall.

Do I need to install anything?

No. It runs in any modern browser on desktop or mobile, with nothing to download and nothing to configure.

Does it stay local?

Yes. The text you paste is processed entirely in your browser and never uploaded to a server.

Why did my URL get mangled into percent signs?

Because this tool encodes a component, not an entire address. encodeURIComponent is deliberately aggressive: it assumes the string you gave it is a single value that must survive being dropped into any position in a URL, so it escapes every reserved character including the colon and the slashes of the scheme. If you want to pass a URL as the value of a redirect or callback parameter, that aggressive escaping is exactly right. If you wanted a clickable link, you did not need to encode it at all.

Should spaces become %20 or a plus sign?

In a URL, %20. The plus sign only means space inside an application/x-www-form-urlencoded body, which is the format a classic HTML form POST uses. Servers that parse query strings usually accept both, but the reverse is not true: a literal plus in a URL path is a plus, not a space. When in doubt, %20 is the safer output, and this tool always produces it.

Does percent-encoding make a value safe from injection?

It makes it safe for the URL layer, and nothing else. Percent-encoding stops a value from breaking out of its slot in the query string. It does not sanitise the value for HTML (you still need HTML escaping to avoid XSS), for SQL (you still need parameterised queries), or for a shell. Encoding is per-context, and a value that has been made safe for a URL is not thereby safe anywhere else.

Why are characters like parentheses and apostrophes not encoded?

They are legal in a URI component under RFC 3986, so encodeURIComponent leaves them alone. In practice they cause trouble anyway: chat apps, markdown parsers, and email clients often stop auto-linking a URL at a parenthesis, so a link ending in one gets cut short. If your value will be pasted into a message, consider escaping them yourself as %28 and %29.

Is my input sent anywhere?

No. The encoding is a single call to a JavaScript function that runs in your browser. Nothing is transmitted, which matters if the value you are encoding is a token, a signed URL, or a customer identifier.

Recommendations

You Might Also Like

Nearby tools from the catalog that fit the same job or workflow.

ENC
UtilityLinks

URL Encoder

Encode URL-safe text

Encode plain text for safe use inside full URLs, query strings, query values, and path segments.

URL
UtilityURL

URL Decode

Decode a URL-encoded string

Decode a percent-encoded URL string back into readable text. Free, in your browser, nothing is uploaded.

URL
UtilityURL

URL Parser

Parse a URL into parts

Break a URL into its protocol, host, port, path, query parameters, and hash. Free, in your browser, nothing is uploaded.

DEC
UtilityLinks

URL Decoder

Decode encoded URLs

Decode URL-encoded strings, query values, and path segments into readable text locally.

B64
UtilityBase64

Base64 Encode

Encode text to Base64

Encode text into a Base64 string. Free, in your browser, nothing is uploaded.

HTML
UtilityHTML

HTML Encode

Encode text to HTML entities

Escape text into HTML entities so it displays as plain text in a page. Free, in your browser, nothing is uploaded.

Cleanor app

Do it all on your device

Cleanor puts these tools in one app: compress and convert images, video, and audio, work with PDFs, and scan text right on your device. Plus free up storage and clear inbox clutter with Email Cleaner. Start with a free trial.

  • iPhone
  • Android
  • Macsoon
  • Windowssoon
Get it on the App StoreGet it on Google PlayAll platforms & pricing