Home / Developer tools / Percent-encoding

Percent-Encoding Converter

Encode or decode text and see exactly how each character becomes bytes and %XX codes. A table lists the character, its Unicode code point, its UTF-8 bytes and whether it needs encoding.

Try:

Everything runs in your browser. Your text is not sent to our server.

How percent-encoding works

Percent-encoding (RFC 3986, section 2.1) has three steps. First the character is converted to bytes with UTF-8. Then each byte is written as % plus two hex digits. Then the codes are joined. ASCII characters are one byte, so a space (byte 20) is %20. Other characters use two to four bytes:

CharacterCode pointUTF-8 bytesPercent-encoded
spaceU+002020%20
%U+002525%25
éU+00E9C3 A9%C3%A9
€U+20ACE2 82 AC%E2%82%AC
م (Arabic meem)U+0645D9 85%D9%85
😀U+1F600F0 9F 98 80%F0%9F%98%80

Pick Encode to see this table for your own text, or Decode to see which bytes each %XX group contains and which character they form.

Reserved and unreserved characters

RFC 3986 sorts characters into three groups:

GroupCharactersRule
UnreservedA-Z a-z 0-9 - . _ ~Never need encoding. Encoding them is allowed but pointless.
Reserved: gen-delims: / ? # [ ] @Structure the URL. Encode them when they are part of a value.
Reserved: sub-delims! $ & ' ( ) * + , ; =Separate parts inside a component. Encode them when they are data.
Everything elsespace, " % < > \ ^ ` { | }, all non-ASCIIMust always be encoded.

The codes you will meet most often

CharCodeCharCodeCharCodeCharCode
space%20!%21"%22#%23
$%24%%25&%26'%27
(%28)%29+%2B,%2C
/%2F:%3A;%3B<%3C
=%3D>%3E?%3F@%40
[%5B\%5C]%5D^%5E
`%60{%7B|%7C}%7D

Upper or lower case hex?

%2f and %2F mean the same byte, but RFC 3986 recommends uppercase, and some systems that compare URLs as plain strings treat the two as different. Signature schemes such as OAuth 1.0 and AWS Signature require uppercase. Use the URL encoder to choose the case.

Percent-encoding is not encryption

Anyone can decode %XX codes. They protect the structure of a URL, not its secrecy, so never rely on them to hide a password or a token. Related encodings are different: HTML entities (&amp;) are for web page text, and Base64 is for binary data.

See also the URL decoder, the encodeURI vs encodeURIComponent comparison and the URL encoding guide.

Frequently asked questions

What is percent-encoding?

It is the way URLs carry characters that are not safe. Each byte is written as a percent sign and two hex digits, such as %20 for a space.

Why does one character become several %XX codes?

Characters outside ASCII use two to four bytes in UTF-8. Each byte gets its own code, so é is %C3%A9 and an emoji is four codes.

Which characters never need to be encoded?

Letters, digits and the four characters - . _ ~ . They are called unreserved characters.

What is the code for a space?

%20. In HTML form data, a + is also used for a space.

Is percent-encoding the same as URL encoding?

Yes. The two names are used for the same method. URL encoding is the common name, percent-encoding is the name in the standard.