How to Encode and Decode URLs Correctly

URLs cannot contain spaces, non-ASCII characters, or reserved symbols like ampersands and question marks — unless they are properly encoded. URL encoding (also called percent-encoding) replaces unsafe characters with a percent sign followed by two hex digits. Getting encoding right prevents broken links, 404 errors, and security vulnerabilities.

What gets encoded and why

Spaces become %20 (or + in query strings). The ampersand becomes %26 because an unencoded ampersand would be interpreted as a new query parameter separator. The ToolStand URL Encoder and Decoder handles all these rules. Paste any text and click Encode to get a URL-safe string, or paste an encoded URL and click Decode to see the original.

Common use cases

Query parameters with special characters. If a user searches for "AT&T earnings," the ampersand must be encoded as %26 or the URL breaks. Non-ASCII characters. URLs with Chinese, Arabic, or emoji characters must be percent-encoded for compatibility. Dynamic link generation. When you build URLs programmatically, always encode user-supplied values before inserting them into query strings to prevent injection attacks.

Encoding vs. decoding: when to use each

Encode before sending a URL: when building links, creating API requests, or sharing URLs that contain user data. Decode when receiving a URL: when parsing incoming requests, reading query parameters from logs, or trying to understand what a garbled URL actually contains. The bidirectional converter makes both operations equally fast.

Explore all 109 free tools at toolstand.io. Free, forever. No sign-up. No download. Just tools that work.