URL encode and decode

Choose encode when text must travel safely as a URL component, or decode when logs, redirects, query values, and copied links contain percent escapes. The operation is deterministic, keeps no state, and rejects malformed percent sequences instead of silently producing misleading output. It runs directly in the browser for interactive work, while the same behavior is available through the API for $0.002 per item.

When to percent-encode a value

URLs use a small set of characters as structure: slashes separate path segments, question marks begin queries, ampersands separate parameters, equals signs divide names from values, and hash signs introduce fragments. When one of those characters belongs to the data rather than the surrounding URL, it must not be confused with that structure. Encoding converts the input to UTF-8 and writes every byte that is not an RFC 3986 unreserved character as a percent sign followed by two hexadecimal digits. Letters, digits, hyphens, periods, underscores, and tildes remain readable. Spaces become <code>%20</code>, not a plus sign, and reserved punctuation is escaped because this capability treats the supplied string as a value rather than as a complete URL. That behavior is useful for query parameter values, individual path segments, redirect targets placed inside another URL, and identifiers containing non-ASCII characters. Encode only the data component you are inserting; encoding an already assembled URL would also escape its structural delimiters.

How strict decoding protects your data

Decoding scans the entire input before returning a value. Every percent sign must be followed by exactly two hexadecimal digits, so inputs such as <code>%</code>, <code>%2</code>, and <code>%GG</code> fail with an invalid-input error. After that structural check, the escaped bytes must form valid UTF-8. A syntactically plausible sequence can still be invalid text, and accepting it with replacement characters would hide corruption in a log, callback, signature base string, or imported dataset. The tool therefore reports an error instead. Decoding does not turn plus signs into spaces: that substitution belongs to the HTML form encoding convention, while this capability follows RFC 3986 percent encoding. It also performs one decoding pass only. For example, <code>%2520</code> becomes <code>%20</code>, not a space. A second pass must be requested explicitly, which helps prevent accidental double decoding and makes each transformation visible and reproducible in automated workflows.

Using the result safely in applications

Select the mode deliberately and pass the exact string that represents one logical value. In encode mode, store or insert the returned result without applying another URL encoder, because double encoding changes each percent sign into <code>%25</code>. In decode mode, treat the returned text as data, not as trusted markup, a filesystem path, or an instruction. Percent decoding restores characters but does not validate their meaning for a later destination. This distinction matters when a service receives callback parameters, examines access logs, normalizes imported links, or compares canonical identifiers. The algorithm is deterministic and has no network access, randomness, clock dependency, or retained state, so identical inputs produce identical outputs. Interactive browser use is convenient for debugging a single troublesome value; the API is better for repeatable validation in tests, ingestion pipelines, and developer tooling. A request costs $0.002 per item through the API, while the browser execution uses the same pure transformation logic.