Why did decoding fail with URI malformed?

A percent sign must be followed by exactly two hexadecimal digits (0-9, A-F). Sequences like %2G or a lone % are invalid and the decoder reports the position of the first bad one so you can fix it.

What does double-encoding mean?

If your input already contains %XX sequences and you encode again, the percent signs themselves get escaped (%20 becomes %2520). The tool warns you when the input looks already-encoded so you can decode instead.

URL Encoder & Decoder — Percent-Encode URLs

📋

Walk-through

How to Use This Calculator

4 steps

1

Pick a direction

Choose Encode to make text safe to put inside a URL, or Decode to turn percent-encoding (like %20) back into readable text. The output pane updates live as you type, so there is no Calculate button to press.

2

Choose Component or Full-URL mode

Use Component mode (encodeURIComponent) for a single query value or path segment — it escapes the structural characters / ? & = #. Use Full URL mode (encodeURI) when you want to encode a complete URL without breaking its scheme, host, and separators.

3

Paste your text

Type or paste into the Input box. The tool reports how many characters were encoded (or how many %XX sequences were decoded) and warns you if the input already looks encoded, so you do not accidentally double-encode it.

4

Copy, download, or reverse

Copy the result to your clipboard, download it as a .txt file, or hit Swap to move the output back into the input and flip the direction — a one-click way to verify a round trip. Use the Batch tab for many values at once, or the Query String tab to edit URL parameters in a table.

⚡

Reference

Formula & Methodology

3 formulas

Percent-encoding rule

unsafe byte 0xHH → "%" + HH (uppercase hex)

Any character that is not allowed unescaped is first converted to its UTF-8 bytes, and each byte is written as a percent sign followed by two hexadecimal digits. A space becomes %20; the emoji 🚀 (four UTF-8 bytes) becomes %F0%9F%9A%80.

encodeURIComponent vs encodeURI

component: escapes A–Z a–z 0–9 - _ . ! ~ * ' ( ) are kept, everything else escaped full: also keeps ; / ? : @ &amp; = + $ , #

encodeURIComponent leaves only the RFC 3986 unreserved set unescaped, so reserved separators get escaped — correct for one value. encodeURI additionally preserves the reserved characters that delimit a URL, so it never breaks a whole URL but will not protect a value that itself contains a / or &.

Spaces: + versus %20

path / modern encoding: space → %20 application/x-www-form-urlencoded: space → +

encodeURIComponent always produces %20 for a space. The plus sign only means space inside an HTML form submission's query string. When decoding such a string, enable "Treat + as space" so a literal + that was a space comes back correctly.

📖

Glossary

Key Terms Explained

7 terms

Percent-encoding Also called URL encoding. The mechanism defined by RFC 3986 for representing a byte that is not allowed (or is reserved) in a URL as a percent sign followed by two hexadecimal digits, e.g. %2F for a slash.

Reserved characters Characters that have a special structural meaning in a URL: : / ? # [ ] @ ! $ & ' ( ) * + , ; =. They must be escaped when they appear inside data rather than as delimiters.

Unreserved characters Characters that are always safe and never need escaping: the letters A–Z and a–z, the digits 0–9, and the four marks - _ . ~.

Query string The part of a URL after the ? — a list of key=value pairs joined by &. Each key and value should be percent-encoded so that an & or = inside a value is not mistaken for a separator.

encodeURIComponent A built-in JavaScript function that escapes every reserved and unsafe character, including / ? & = #. Used for a single query-string value or path segment — the "Component" mode in this tool.

encodeURI A built-in JavaScript function that escapes unsafe characters but preserves the reserved characters that give a URL its structure. Used to encode a complete URL — the "Full URL" mode here.

URI vs URL A URI (Uniform Resource Identifier) is the general identifier syntax; a URL (Uniform Resource Locator) is a URI that also tells you how to locate the resource (its scheme and address). In everyday use the terms are interchangeable for web addresses.

👥

Scenarios

Real-World Examples

3 worked examples

🔎

Mara — building a search link

Mara needs a shareable search URL whose query holds the phrase "running shoes & socks". Dropping it in raw would let the & end the parameter early.

Mode Encode · Component Input running shoes & socks

The output is running%20shoes%20%26%20socks — 3 characters were encoded (two spaces and the ampersand). Mara drops it after q= to get …/search?q=running%20shoes%20%26%20socks, which survives copy-paste and email intact.

🛠️

Devon — a decode that fails

A log line shows discount=50%off and Devon pastes it into Decode mode expecting plain text, but gets a URI malformed error.

Mode Decode · Component Input discount=50%off

The tool reports a malformed percent sequence near position 11 ("%of"). The % was a literal percent sign, not an escape. The fix is to encode the source correctly as 50%25off (%25 is a literal %), after which decoding returns 50%off cleanly.

📣

Priya — assembling UTM tags

Priya pastes https://shop.com/sale?utm_source=spring news&utm_campaign=20% off into the Query String tab to clean it up.

Tab Query String Action Parse, edit, rebuild

The table shows utm_source = "spring news" and utm_campaign = "20% off" decoded for easy editing. The rebuilt URL re-encodes them as utm_source=spring%20news&utm_campaign=20%25%20off — every value safely escaped and ready to paste into an ad platform.

📄

Deep Dive

URL Encoding Explained: encodeURIComponent vs encodeURI, + vs %20, and Why Decoding Fails

3 chapters · 5 min read

URLs can only contain a limited set of ASCII characters, so anything else — spaces, accents, emoji, or the reserved separators that structure a URL — has to be percent-encoded. This tool encodes and decodes that representation entirely in your browser. This guide explains when to reach for component versus full-URL encoding, why a space is sometimes a + and sometimes %20, and how to read a decode error.

When to use encodeURIComponent vs encodeURI

The two functions differ only in which characters they protect. encodeURIComponent escapes everything except the unreserved set (letters, digits, and - _ . ! ~ * ' ( )), so reserved separators like / ? & = # are turned into %2F %3F %26 %3D %23. That is exactly what you want for a single piece of data — one query value, one path segment — because it guarantees the value cannot be misread as structure.

encodeURI is meant for a whole URL. It leaves the reserved characters that delimit a URL untouched, so https://x.com/a?b=c stays usable. The trade-off: it will not protect a value that itself contains a / or &. Rule of thumb: encode each value with component mode first, then assemble the URL; only use full-URL mode when you have a finished URL that merely contains a stray space or accent.

Reserved characters and the + vs %20 confusion

RFC 3986 calls these the reserved characters: : / ? # [ ] @ ! $ & ' ( ) * + , ; =. Inside data they must be escaped; as delimiters they must not be. The most common source of bugs is the space. Modern percent-encoding always writes a space as %20. But the older application/x-www-form-urlencoded format — what a browser produces when it submits an HTML form — encodes a space in the query string as +. So ?q=a+b and ?q=a%20b can both mean "a b". When you decode a form-style string, turn on Treat + as space; when you decode a path or a modern API URL, leave it off so a literal + stays a +.

Why decoding fails, and double-encoding

Decoding throws a URI malformed error when a % is not followed by exactly two hex digits (0–9 A–F). A literal percent sign in source text, like 50% off, is the usual culprit — it should have been encoded as %2520… no, as 50%25 off, where %25 is the escaped percent. The tool points at the position of the first bad sequence so you can locate it. The opposite hazard is double-encoding: if you encode a string that already contains %XX, the percent signs themselves get escaped and %20 becomes %2520. The tool detects already-encoded input and warns you to decode instead.

Privacy: every operation here runs locally with the browser's native encodeURIComponent, encodeURI, decodeURIComponent, and decodeURI. Nothing you paste — tokens, query strings, personal data — is ever sent to a server.

❓

Questions

Frequently Asked Questions

7 questions

What is the difference between encodeURIComponent and encodeURI?+

encodeURIComponent (Component mode) escapes almost every reserved character, including / ? & = #, so it is correct for a single query value or path segment. encodeURI (Full URL mode) leaves the characters that give a URL its structure unescaped, so use it to encode a complete URL without breaking it. As a rule, encode individual values with Component mode, then assemble the URL.

Why is a space sometimes + and sometimes %20?+

In a path or with modern percent-encoding, a space is %20. In the older application/x-www-form-urlencoded format that HTML form submissions use, a space in the query string can be a +. Both should decode to a space — enable "Treat + as space" when decoding form-style strings so a + that represents a space comes back correctly.

What does %20 mean?+

%20 is the percent-encoded representation of a space character: the byte 0x20 in hexadecimal. Percent-encoding writes any unsafe byte as a % followed by its two hex digits, so a space (32 in decimal, 20 in hex) becomes %20.

Is my data sent to a server?+

No. All encoding and decoding happens locally in your browser using the built-in encodeURIComponent, encodeURI, decodeURIComponent, and decodeURI functions. Nothing you type — including tokens or query strings — is uploaded anywhere.

Why did decoding fail with a URI malformed error?+

A percent sign must be followed by exactly two hexadecimal digits (0-9, A-F). Sequences like %2G, or a lone % such as in "50% off", are invalid. The decoder reports the position of the first bad sequence so you can fix it — usually by escaping the literal percent as %25.

Can I encode a whole URL without breaking it?+

Yes — switch to Full URL mode, which uses encodeURI. It escapes unsafe characters such as spaces and accents while preserving the : / ? & = # that structure the URL. Note it will not protect a query value that itself contains a / or &; for that, encode the value separately in Component mode.

What is double-encoding and how do I avoid it?+

Double-encoding happens when you encode a string that already contains %XX sequences — the percent signs get escaped again, turning %20 into %2520. This tool warns you when the input already looks encoded. If you see the warning and meant to reverse the string, switch to Decode instead of Encode.

Download a one-page PDF of your numbers instantly. Add your email to also get our occasional calculator tips — no spam, unsubscribe anytime. Privacy.

URL Encoder & Decoder