URL encoder & decoder — offline

URLs are one of the most credential-dense things developers handle. Password reset links, OAuth callbacks with authorization codes, signed S3 URLs, session identifiers, API keys someone put in a query string years ago — all of it travels in the URL itself. Pasting one into an online encoder hands over a working credential, and unlike a leaked password there is often nothing to rotate.

Encoding and decoding here use the browser's own built-in functions on this page. Nothing is transmitted; the site has no backend, and a Content-Security-Policy blocks third-party requests. That is precisely why a URL tool should be local.

This is the distinction that causes most percent-encoding bugs, and the two modes map onto the two JavaScript functions:

• Component (encodeURIComponent) encodes everything with special meaning, including /, ?, &, and =. Use it for a single query-string value. This is the one you want when embedding a URL inside another URL — a redirect parameter, for instance — because the inner URL's own separators must not be read as part of the outer one.
• Full URL (encodeURI) preserves the characters that give a URL its structure and only encodes genuinely unsafe ones, such as spaces. Use it to clean up a complete URL you want to remain a working URL.

Getting this backwards is the source of the classic bug where a redirect parameter silently truncates at the first &, dropping everything after it.

Decoding turns %20, %2F and the rest back into readable characters, which is how you make sense of a long tracking-laden link or work out what a logged request actually asked for. A + is treated as a space, matching how HTML forms encode query strings.

If a decoded string still contains percent sequences, it was double-encoded: something encoded an already-encoded value, turning each % into %25. Decode again to get the original. Seeing %2520 in a URL is the signature of exactly this bug in a pipeline.

Also entirely client-side: Base64 encoding, including the URL-safe variant used in tokens, and HTML entity encoding for text headed into markup rather than a URL.