URLs can only contain a limited set of characters. Spaces, ampersands, question marks, and non-ASCII letters all have special meaning or are simply not allowed. Percent-encoding, often called URL encoding, solves this by replacing unsafe characters with a % followed by two hexadecimal digits. The ToolOrbit URL Encode / Decode tool makes this reliable and lets you choose the right scope for the job.
How percent-encoding works
Each byte that is not allowed in a URL is converted to its hexadecimal value preceded by a percent sign. A space becomes %20, an ampersand becomes %26, and a non-ASCII character is first encoded as UTF-8 bytes, each of which is then percent-encoded. Decoding simply reverses the process.
hello world & friends -> hello%20world%20%26%20friends cafe (UTF-8 accent) -> ca%C3%A9
Component vs full URL encoding
This is the single most important distinction. When you encode a value that will sit inside a query parameter, you must encode reserved characters like &, =, ?, and / so they do not change the structure of the URL. When you have an already-assembled URL and only want to fix spaces and illegal characters, you must leave those structural characters intact.
- Component mode (like encodeURIComponent): use for individual query values, path segments, or form fields
- Full URL mode (like encodeURI): use for an entire URL where the structure is already correct
- Always encode user input as a component before stitching it into a query string
- Never double-encode: encoding an already-encoded string turns % into %25
Using the tool
Paste your text, pick component or full URL mode, and switch between encode and decode. Everything happens locally in your browser, so internal URLs and tokens never leave your machine. Decode mode is handy for reading the real values behind a long, percent-heavy analytics link.
Best practices
Encode early and decode late: encode each value the moment you place it into a URL, and decode only when you read it back. When in doubt, treat every dynamic value as a component. This keeps your URLs valid, your query parameters intact, and your redirects working as intended.
The line between encode(whole URL) and encode(part)
In JavaScript, encodeURI() leaves structural characters (/, :, ?, &, =) alone so a whole URL survives; encodeURIComponent() encodes even those, so a single value is safe to embed in an already-valid URL. Getting this backwards is the classic “why is my query broken” bug: encode the path using the first, encode values using the second. Test the finished link in the tool before shipping it — a percent-encoded URL that fails pasting into a client is still failure.
