What is percent-encoding? A guide to URL encoding for developers

Percent-encoding (also called URL encoding) replaces characters that aren't safe in a URL with a percent sign followed by two hex digits. Spaces become %20, ampersands become %26, and so on. Any character outside the unreserved set (A-Z, a-z, 0-9, hyphen, underscore, period, tilde) must be percent-encoded for a URL to be valid.

Encoding focus
URL encoding guide
url-encoding
Category
Best Practices
Practical encoding guidance

How this is calculated

Different parts of a URL have different reserved characters. The query string reserves ? & = and #. The path reserves / ? and #. This is why you can't just encode everything the same way. JavaScript's encodeURIComponent() encodes everything except the unreserved set, which is correct for query parameter values. encodeURI() is less aggressive and keeps URL structure characters intact, which is correct for encoding a full URL. Using the wrong one causes double-encoding bugs (%%2F instead of %2F) or under-encoding (a raw & in a query value that breaks parsing).

Verdict

Use encodeURIComponent() for individual query parameter values. Use encodeURI() for full URLs. Never hand-roll percent-encoding. If you need URL-safe Base64 (for JWT tokens in URLs), use the URL-safe variant that replaces + with - and / with _.

More Encoding scenarios

Frequently asked questions

How do I convert text to Base64?
Paste your string into the Text field and the Base64 output appears instantly. The tool uses standard Base64 (RFC 4648), so the output is identical to Linux's base64 command and every major language's built-in Base64 encoder.
What's the difference between Base64 and hex encoding?
Both represent binary data as text, but with different alphabets. Base64 uses 64 characters and needs roughly 4 chars per 3 bytes (33% overhead). Hex uses 16 characters and needs exactly 2 chars per byte (100% overhead). Base64 is denser, while hex is easier to read byte by byte.
Why does my UTF-8 text break when converted to binary?
UTF-8 encodes non-ASCII characters as multibyte sequences, so a single emoji or accented letter becomes 2-4 bytes. The binary output will be longer than the character count suggests, that's correct behavior, not a bug.
Is it safe to paste sensitive data into the converter?
Yes. The encoding conversion runs entirely in your browser with JavaScript, nothing is sent to our servers, logged, or stored. You can verify this with your browser's Network tab: no requests fire when you type.
What is URL-safe Base64?
A variant that replaces `+` with `-` and `/` with `_` so the result can be safely placed in URLs without percent-encoding. JWT tokens use URL-safe Base64. Standard Base64 is fine for most other uses.
Can I decode Base64 back to the original text?
Yes, the converter is bidirectional. Paste Base64 into the Base64 field and you'll get the original UTF-8 string back. If decoding fails silently, the input isn't valid Base64 (wrong characters, bad padding, or it was double-encoded).