encodeURIComponent is more aggressive — encodes everything except safe. encodeURI preserves URL structure.
Character
encodeURIComponent
encodeURI
A–Z a–z 0–9
Not encoded
Not encoded
- _ . ! ~ * ' ( )
Not encoded
Not encoded
: / ? # @ &
%3A %2F %3F %23 %40 %26
Not encoded
= + , ;
%3D %2B %2C %3B
Not encoded
Space
%20
%20
Cyrillic А–Я а–я
%D0%9F… (UTF-8)
%D0%9F… (UTF-8)
Chinese, Arabic, emoji
%XX%XX… (UTF-8)
%XX%XX… (UTF-8)
03
About URL encoding
URL encoding (percent-encoding) represents any character in a URL using ASCII sequences like %XX, where XX is a UTF-8 byte in hex. Necessary because a URL can only contain a limited set of safe characters.
Choose the function by task: encodeURIComponent — for a single query parameter value. encodeURI — for a full URL when you need to preserve its syntax (colons, slashes, question marks).
encodeURIComponent
most common
'hello world!' → hello%20world!
Encodes everything except letters, digits and `- _ . ! ~ * ' ( )`. Characters `: / ? # @ & =` are also encoded — so a parameter value won't break the URL structure. Use for query values ?q=… and form data.
encodeURI
for full URLs
'https://site.tld/path' → 'https://site.tld/path'
Preserves URL structure: does not encode `: / ? # [ ] @ ! $ & ' ( ) * + , ; =`. Use when you need to pass a full URL as a string without breaking its syntax.
Decoding
%D0%BF%D1%80%D0%B8%D0%B2%D0%B5%D1%82 → 'привет'
The inverse operation — turns %XX sequences back into readable text. Also supports the `+` for space format from HTML forms (application/x-www-form-urlencoded).
Percent-encoding
RFC 3986
%XX — where XX is the hex byte in UTF-8
Each unsafe character is written as `%XX`, where XX is the hex byte in UTF-8. Cyrillic takes 2 bytes (6 %XX%XX chars per letter), emoji up to 4 bytes.
04
Frequently asked questions
Paste the text and pick the encoding you need — the tool replaces every character a URL cannot carry with a percent sequence. A space becomes `%20`, a slash `%2F`, and non-Latin letters expand to two or three pairs each, because percent encoding works on UTF-8 bytes rather than on characters.
It is one byte written as a percent sign and two hexadecimal digits: `%20` is a space. Percent encoding exists because a URL may only contain a limited set of characters, so anything else — spaces, punctuation, any non-Latin letter — travels as its byte values. Decoding turns the sequences back into text.
They differ in what they leave alone. `encodeURI` preserves `: / ? # & =` because it is meant for a whole address. `encodeURIComponent` encodes those too, because it is meant for a single parameter value that may itself contain slashes or ampersands. Using the wrong one is how query strings end up split in the wrong places.
A plus is how form data encodes a space under `application/x-www-form-urlencoded`, and by convention it is also accepted in query strings. Elsewhere in a URL a space is `%20`, and inside a path a plus stays a literal plus. Decoding here treats `+` as a space, which is what form-encoded strings need.
Because the string was encoded twice. `%25` is the encoded form of the percent sign itself, so `%25D0` is what a first-pass decode leaves behind when `%D0` had already been encoded once. Run the decode again and the original text appears — double encoding almost always means two layers of code each escaped the same value.
No. Encoding and decoding run in your browser and the address never leaves the device. That matters more here than elsewhere: links routinely carry authorisation tokens, API keys and session identifiers, and pasting one into a service that processes text server-side hands over working access. Only the name of the opened tool is sent.