URL Encoder and Decoder: What It Is, How It Works, and When to Use It

Okay so you know we use URLs daily. Like google.com, youtube.com, facebook.com... we type them, we click them.

But have you ever noticed sometimes a URL looks super weird? Like

https://example.com/search?q=hello%20world

What is this %20? Why is there % everywhere? I used to think my browser is broken lol.

Then I learned this thing called URL encoding.

So what is URL encoding?

See, URLs have some rules. You can't just put anything inside a URL.

Like you can't put a space. You can't put &, ?, #, = randomly in your search text. Because these characters already have a special meaning in URL.

? means query starts

& means next parameter

= means value

means hashtag anchor

/ means folder

So if your actual data contains these characters, browser gets confused. Is this & part of your search or is it separating two parameters?

That's why we encode.

Encoding means - we replace that confusing character with % plus some numbers.

For example space becomes %20

So hello world becomes hello%20world

Same info, just written in a way URL can understand. That's it.

And URL decoding is opposite

Decoding is reverse.

If you see hello%20world and you want to read it normally, you decode it.

%20 becomes space again. So hello%20world -> hello world.

Simple example.

You want to search "best coffee shops" on a site. The URL would be

But there is space between best and coffee. URLs don't like spaces.

So it becomes

https://example.com/search?q=best%20coffee%20shops

Now URL is happy. Browser can send it.

Another example - you search "red shoes & boots"

That & is dangerous. Because in URL, & means next parameter starts. So if you put

q=red shoes & boots

Server will think q=red shoes and then a new parameter boots=... which is wrong.

So you encode & as %26

q=red%20shoes%20%26%20boots

Now server knows & is part of your search, not a separator.

What is this percent encoding?

You see %20, %26, %3F etc. Why %?

Because encoding uses % sign plus two hex digits.

Like:

Space = %20

! = %21

" = %22

= %23

$ = %24

% itself = %25 (yes % also needs encoding)

& = %26

' = %27

( = %28

) = %29

= %2B

/ = %2F

: = %3A

= = %3D

? = %3F

You don't need to remember all this. Tool does it for you. But good to know.

Encoding vs Decoding - quick

Encoding = normal text -> percent-encoded text

hello world -> hello%20world

Decoding = percent-encoded text -> normal text

hello%20world -> hello world

That's the whole game.

How to use an encoder? I do like this

I have one online tool bookmarked.

I paste my text. Like hello world

I click Encode

It gives hello%20world. I copy it and paste in my URL.

For decoding opposite -

Paste hello%20world

Click Decode

Get hello world back.

Space problem - %20 vs +

This confuses everyone.

So space can be encoded as %20 normally.

So best coffee shops can become

best%20coffee%20shops (normal)

best+coffee+shops (in form data)

Both mean space but in different contexts. So %20 and + are NOT always same. Important.

Query parameters - where most people need it

URL like https://example.com/search?q=website

q is name, website is value.

If your value has spaces or special characters, you encode only the value, not full URL.

Wrong way: encode whole https://example.com/search?q=hello world -> you will encode : and / also and break the URL.

Right way: only encode hello world part.

This mistake I did a lot in beginning.

Why developers use it so much?

We deal with APIs, search, filters.

Suppose user types "red shoes & boots" in search box. If I put that directly in URL without encoding, my API will break. & will split parameters.

So we always encode user input before putting in URL.

red%20shoes%20%26%20boots

Now safe.

For production code we don't use online tools, we use code - like encodeURIComponent in JavaScript. But for testing, debugging, learning - online encoder is super fast.

What about Urdu, Arabic, Hindi characters?

Modern URLs support all languages.

Like if you search in Urdu, that Urdu text also gets encoded. Each Urdu letter becomes UTF-8 bytes and then % encoding. So it looks like %D8%B9 etc.

It looks scary but it's just Urdu in encoded form. When you decode with UTF-8, you get Urdu back.

That's why UTF-8 matters. It's the system that can represent almost all languages in the world. When you encode non-English text, it first converts to UTF-8 bytes then to %.

Reserved vs Unreserved characters

Some characters are safe - you can put them directly.

Others are reserved - they have meaning. Like : / ? # [ ] @ ! $ & ' ( ) * + , ; =

Whether you encode them or not depends where you use them. If you use : as part of https:// you don't encode. If you use : inside a search query as data, you encode.

That's why you should think before encoding.

Should you encode entire URL?

Please don't.

I see beginners do this. They take https://example.com and encode full thing to https%3A%2F%2Fexample.com

Now it's not a URL anymore. You broke the : and // which are needed.

Only encode the part that is data - like query value. Not full URL.

URL encoding vs HTML encoding vs Base64 - different things

URL encoding is for URLs only.

HTML encoding is different - like & becomes & in HTML. That's for showing special chars safely in webpage, not for URLs.

Base64 is totally different - it converts binary data to text like SGVsbG8=. That's not for URL safety.

Mistakes I see everyone make

Encoding whole URL instead of just parameter

Double encoding - like you encode hello%20world again, % becomes %25 so %20 becomes %2520. Now double encoded, server will read wrong.

Decoding something that should not be decoded

Confusing + with %20. + is space only in form data, not everywhere. If you actually need plus sign as data, it must be %2B.

Forgetting UTF-8 for non-English. If you decode with wrong encoding, Urdu/Arabic will show as garbage.

Is URL encoding secure? Is it encryption?

No no no. Not at all.

%20 is not hiding anything. Anyone can decode it in 1 second.

So if you encode password%123 it's still visible, not secure. Don't think encoding = protection.

For security you need HTTPS, authentication, etc. Encoding is just for representation, not security.

It can HELP with security a bit by preventing parsing issues, but alone it's not security.

When should you use decoder?

When you see a weird URL full of % and want to understand it.

Like you see search%3Dweb%20tools - what is this? Decode it, it becomes search=web tools. Now readable.

Developers use decoder a lot while debugging API, redirects, form data.

Students use it to learn how browser actually sends data.

Does it help in SEO?

Kinda.

Goal is not to avoid encoding fully, but to keep URLs clean and meaningful while encoding only where needed.

Browsers already do it automatically?

Yes, modern browsers do a lot automatically. If you type space in address bar, browser internally converts to %20.

And in code, we have functions.

But still, online encoder/decoder is useful when you want to see what's happening, test quickly, or learn.

Online tool - when I use it

I use it when:

Debugging a URL that's not working

Testing API query params

Checking what special characters become

Teaching someone how % encoding works

Quickly encoding a value to paste

For simple work, online tool saves so much time, no need to write code.

Quick FAQ

What is URL encoder? Tool that converts characters like space to %20 so they can go safely in URL.

What is decoder? Opposite, converts %20 back to space.

What is %20? It's space.

Is URL encoding encryption? No, it's just representation, anyone can decode.

Why encode special chars? Because some chars like & ? = have special meaning in URL, so if they are part of data they need encoding.

Can I encode whole URL? You can but you shouldn't. Only encode data part, like query value.

What is percent encoding? Using % plus two hex digits to represent a character.

Can it handle Urdu/Arabic? Yes, using UTF-8 then percent encoding.

Is decoder safe? For normal URLs yes, just converting. But don't paste sensitive passwords into random third-party sites.

Why %2B for plus? Because + itself can mean space in some contexts, so real plus sign is encoded as %2B.

Final thing

Look, URL encoding / decoding is basic web stuff. Encoding makes characters safe for URL, decoding makes them readable again. It's all about %.

Browser and programming languages handle most of it automatically, but understanding it helps you debug when URL breaks.

And remember - encoding is not encryption. Encoded data is NOT hidden. It's just written differently so URL doesn't get confused.

Use online encoder/decoder for quick tests, but for real apps use proper library functions in your language, and encode only the part that needs it, not the whole URL.