URL Encoder & Decoder
Encode and decode URLs, query strings and parameters safely, with a parameter grid and batch mode — all client-side.
Encode and decode URLs, query strings and parameters safely, with a parameter grid and batch mode — all client-side.
Layerbit's URL Synthesizer features a dual-engine architecture designed specifically for developers handling API endpoints and webhook payloads.
https://domain.com/path) and strictly encodes the query parameters. This prevents broken, unclickable URLs.?key=value) and generates an editable visual breakdown of payload data — edit any key or value and hit Re-encode to rebuild the URL instantly.Ensure complex payloads carrying raw JSON or XML objects via URL parameters do not break routing logic by safely encoding the transmission string.
Securely encode advanced marketing campaign parameters, ensuring spaces and special characters map perfectly into analytics dashboards without data truncation.
Rapidly convert malicious or raw input strings into fully encoded formats to safely analyze cross-site scripting (XSS) payloads in application server logs.
Test the URL encoding engine instantly. Click the templates below to load sample payloads directly into the workspace.
Smart Mode attempts to parse the string using the JavaScript URL API, extracting and modifying the URLSearchParams to safely encode query parameters while preserving the base protocol structure. Raw Mode bypasses URL parsing and applies a blanket encodeURIComponent() to the entire string.
URLs frequently contain highly sensitive session tokens, API keys, and temporary authorization grants within their parameters. Processing this data entirely within your local browser DOM guarantees zero-trust security—your keys are never sent to or logged by our servers.
When a valid URL is detected, the engine intercepts the search property of the parsed URL object. It iterates through the URLSearchParams map, automatically escaping HTML entities to prevent DOM injection, and populates an editable breakdown grid. Edit any key or value directly and click Re-encode to rebuild both the readable and percent-encoded versions of the URL from your changes.
Batch Mode treats each line of the input as an independent item. Every non-empty line is parsed and encoded or decoded on its own — if a line is a full URL, only its query parameters are transformed (same logic as Smart Mode); otherwise the whole line is encoded or decoded as a raw string. Blank lines and line order are preserved, so you can paste a list of endpoints or tracking links and process them all in one pass.
"URL encoding" refers to two different schemes that disagree about the space character, and mixing them up is behind a great many broken links. RFC 3986 percent-encoding represents a space as %20. The application/x-www-form-urlencoded format used by HTML forms represents it as +, and a literal plus as %2B.
Both are correct in their own place. Query strings are form-decoded by most servers, so + reads as a space there — which is why search URLs are full of them. Paths are percent-decoded, so in a path + is a literal plus character. Our URL encoding guide works through the reserved-character rules and the double-encoding signature in detail.
A file named C++ notes.pdf encodes to C%2B%2B%20notes.pdf. If any layer form-decodes that path rather than percent-decoding it, the escaped pluses become spaces and the key no longer matches. "Uploads fine, 404s on download" is almost always this.
%2520 means encoded twiceEncoding is not idempotent: % itself encodes to %25, so running an encoder over already-encoded text produces %2520 from a space. Seeing it in a log tells you two layers each believed they were responsible for encoding.
Smart mode parses the input as a URL and encodes only the query values, preserving the protocol, host and path so the result stays clickable. Raw mode applies strict component encoding to the whole string — correct when the input is a single value rather than a URL.
The rule that resolves most remaining questions: encoding belongs to individual values before the URL is assembled, because only then does the code know which characters are data and which are structure. Encoding an already-assembled URL cannot distinguish them, and the consequence is a parameter-injection bug:
"/search?q=" + encodeURI("a=1&admin=true") yields two parameters — q and an attacker-supplied admin.encodeURIComponent on the same value yields a%3D1%26admin%3Dtrue: one parameter, correctly escaped.In practice, prefer URLSearchParams over either function. It escapes each value correctly, handles repeated keys, and cannot produce an injection because it never treats your data as syntax. Its one quirk is that it form-encodes, so spaces come out as + — which, in a query string, is exactly right.
One thing to avoid entirely: decoding repeatedly until the string stops changing. That is how path-traversal filters get bypassed, because %252e%252e%252f passes a check for ../ and then becomes ../ after a second decode. Decode exactly once, then validate.
When a URL has a dozen query parameters, reading it as one string is the hard way. The parameter grid breaks a detected query into editable key/value rows: change a value, add a parameter, remove one, and Re-encode rebuilds both the readable and the percent-encoded forms of the URL. Batch mode takes a list of URLs, one per line, and encodes or decodes every line independently — useful for a column of tracking links pulled out of a spreadsheet.
All of it happens in the page. URLs frequently carry session tokens, signed parameters and temporary authorisation grants in their query strings, so nothing you paste here is transmitted anywhere.
&, = and # are percent-encoded instead of being left to change the meaning of a query string. Relative paths keep their separators as before.