URL Encoder / Decoder
Why use a private URL encoder?
URLs carry more secrets than people expect: OAuth codes, password-reset tokens, signed storage links, session IDs, and API keys in query strings. Pasting one into an online decoder can hand a working credential to whoever runs that site.
formatvault encodes and decodes URLs with your browser's built-in functions. Nothing is uploaded or logged, so you can inspect a live callback URL without leaking it.
How it works
Encoding uses the standard encodeURIComponent function, which percent-encodes every character outside the unreserved set as UTF-8 bytes — so emoji and accented characters are handled correctly. Full URL mode uses encodeURI instead, which leaves the URL's scheme, host, path, and query delimiters intact.
Decoding reverses the process with decodeURIComponent and reports malformed sequences instead of producing garbled output. The query parser splits a query string into its parameters and decodes each one.
Common use cases
- Encoding a value before adding it to a query string by hand
- Decoding an OAuth or SSO callback URL to see which parameters came back
- Reading a long query string as a table of decoded parameters
- Debugging double-encoded values such as %2520 in API requests
- Preparing URLs with spaces or Unicode characters for curl or Postman
Frequently asked questions
- What is the difference between component and full URL encoding?
- Component mode encodes every reserved character, which is what you want for a single query parameter value or path segment. Full URL mode keeps the characters that give a URL its structure — such as : / ? # & and = — and encodes everything else, such as spaces and non-ASCII characters. Existing %XX escapes are left as they are.
- Why does my decoded output still contain + signs?
- Standard URL decoding only turns %20 into a space. A + means a space only in HTML form submissions (application/x-www-form-urlencoded), so it is left as-is. Replace + with %20 first if your input came from a form.
- What does the query parameter parser do?
- Paste a query string, with or without the leading ?, and every key and value is listed in a table, decoded. It is a quick way to read the long parameter lists in tracking and redirect URLs.
- Why do I get an error when decoding?
- The input contains a % that is not followed by two hex digits, or a byte sequence that is not valid UTF-8. This usually means the string was only partly encoded or was truncated.
- Is it safe to decode URLs that contain tokens?
- Yes. Encoding and decoding use your browser's built-in functions, and nothing is sent to a server. That matters for OAuth callbacks, signed URLs, and magic links, which often carry live credentials.