URL Encoder / Decoder (SEO)

URLs can only contain certain characters, so spaces, ampersands, and accented letters must be percent-encoded to travel safely — and decoded to be read. This tool encodes and decodes URLs, and goes further with SEO-friendly slug options that turn a messy string into a clean, search-friendly path.

Developers and SEOs use it to encode query values, decode a tracking link to see what is inside, or generate a tidy URL slug from a page title. Beyond standard encoding, it can lowercase text, replace spaces with hyphens, strip special characters, and remove common stop words — and it validates the input as a real URL and lists out its query parameters.

Encoding converts characters that are unsafe or reserved in a URL into a percent sign followed by their hexadecimal byte values. The tool uses component encoding, which is the stricter of the two available modes: it escapes the reserved delimiter characters as well, so the result is safe to place inside a single query value or path segment.

That distinction is the one that causes bugs. A full-URI encoder deliberately leaves delimiters such as the colon, slash, question mark, and ampersand alone so a whole URL survives. A component encoder escapes them, because inside a parameter value those characters would otherwise terminate the value early.

Non-ASCII characters are encoded as their UTF-8 bytes, which is why a single accented letter becomes two percent groups and an emoji becomes four.

Double encoding is the most common practical problem. Encoding an already-encoded string turns each percent sign into %25, so %20 becomes %2520 and the value arrives with literal percent-two-zero in it. Decoding the wrong number of times leaves data subtly corrupted, and it is easy to do when a value passes through several layers that each encode helpfully.

The security consideration is that encoding is not sanitisation. Percent-encoding makes a value safe to transport in a URL; it does nothing to make it safe to insert into HTML, SQL, or a shell command. Each destination needs its own escaping, and attackers have historically used double-encoded payloads specifically to slip past filters that decode once and then validate.

Two practical notes. Build URLs with the platform's own URL and query-string classes rather than by concatenating strings, since they handle the encoding rules correctly. And be aware that the plus-for-space convention applies to query strings but not to path segments, which is a genuine inconsistency in how URLs are read rather than a bug in any particular decoder.