URL encoder / decoder

Three flavors covered: encodeURI, encodeURIComponent, and form-urlencoded (+ for space). Pick the right one before pasting it into a request.

Plain text

Mode:

Component encoder — percent-encodes everything except A-Z, a-z, 0-9, - _ . ! ~ * ' (). Use for query values, path segments.

Which mode? encodeURIComponent is right ~95% of the time — use it for query-string values, path segments, fragment text. Reach for encodeURI only when you have a whole URL and want to keep the structure intact. Use form mode when building application/x-www-form-urlencoded bodies — the server will turn + back into a space.

Keep hardening your site

This is one check of many. Run the rest — every tool is free, no account.

Scan your site's security headers →See the full platform →

Security headers scan

Grade your live response headers

TLS certificate scan

Grade chain, expiry, and key strength

Security headers builder

Emit a ready-to-paste header block

CSP analyzer

Grade your Content-Security-Policy

Cookie security audit

Check Secure, HttpOnly, SameSite

Mixed-content scanner

Find http:// assets on https pages

Open-redirect detector

Probe redirect params for abuse

HSTS preload checker

Grade against Chrome's preload list