URL Encoder, Decoder & Inspector
Encode with the profile the spec actually asks for, unwrap double-encoded redirects, take a link apart down to its credentials and its real hostname, edit the query string by hand, and drop every tracking parameter in one click.
What JavaScript does: escapes everything except A-Z a-z 0-9 and - _ . ! ~ * ' ( ). Fine for a single value, but it leaves the sub-delimiters alone.
How it works
The link arrives
Paste it, open a .txt full of them, or let another oLoveTools tool hand its result straight over. Nothing is processed until you ask.
It comes apart
Scheme, credentials, real hostname, port, path segments and every parameter, each with its raw and its decoded form side by side.
You correct it
Rename a key, reorder the query string, unwrap a double-encoded redirect or drop every tracker. Ctrl+Z undoes any of it.
It leaves clean
Copy it, export the batch as CSV or JSON, or send the result on to another tool without a round trip through your downloads folder.
Eight encoding profiles
encodeURIComponent and encodeURI are only two of the answers. RFC 3986 strict, form-urlencoded, path, query, fragment and RFC 5987 are here too, each with a note on when it is the right one.
A query string you can edit
Rename keys, change values, reorder rows, delete what you do not need. Parameters you never touch are written back byte for byte — even the difference between + and %20 survives.
One-click tracker removal
utm_*, fbclid, gclid, msclkid, mc_eid and dozens more, grouped by where they come from, with the exact number of bytes the cleanup saved.
It tells you what is wrong
Credentials in plain text, a hostname spelled with lookalike letters, a parameter that is really another URL, an escape that has been applied twice — all flagged before you click anything.
Double encoding, unwrapped
Redirect chains arrive encoded two or three times over. Decode until stable unwraps them in one go and tells you how many passes it took.
Whole lists at once
Drop in a text file of links and clean every one of them in a single pass, then export the result as CSV or JSON with the per-URL savings.
The escape that is correct depends on where the value lands
A value going into a path segment, a query string, a form body and a Content-Disposition header needs four different escapes, and JavaScript only ships two of them. URLBolt gives you all eight, tells you which characters each one leaves alone, and verifies that decoding the result reproduces your input exactly before you paste it anywhere.
Nothing leaves your browser
Every operation — encoding, decoding, parsing, punycode conversion, tracker removal, batch cleanup — runs on native browser APIs in your own tab. There is no upload, no request, no server-side step and nothing to log. The links you inspect are frequently the ones you least want to send to a stranger's server, which is exactly why none of them go anywhere.
Built for the links that arrive broken
Affiliate URLs that redirect three times, campaign links carrying a dozen tracking parameters, an API callback that has been percent-encoded twice, a legacy endpoint with the password sitting in the authority, an international domain that your terminal shows as xn--. URLBolt reads all of them, shows the punycode hostname the way a human would write it, unwraps nested redirects, and lets you fix the query string by hand instead of rebuilding the whole address in a text editor.
There is no sign-up, no daily quota and no paid tier hiding the useful half of the tool. Files you open are read locally and never transmitted; the tab forgets everything when you close it.
Frequently Asked Questions
QWhat is the difference between encodeURIComponent and encodeURI?+
encodeURI escapes a whole address but leaves the characters that build URL syntax — : / ? & = + $ , # — intact, so the result is still a working URL. encodeURIComponent escapes those too, which is what you want for a single parameter value. Neither escapes ! ' ( ) *, so if you are signing a request you probably want the RFC 3986 strict profile instead.
QWhy does my decoded text come back with a % still in it?+
Because the input contained a broken escape — a % with fewer than two hex digits after it, or two characters that are not hex at all. Rather than throwing the whole string away, URLBolt keeps the literal % , decodes everything else, and lists the exact offset of each problem so you can see where the link was truncated.
QWhen should spaces be + instead of %20?+
Inside an application/x-www-form-urlencoded body or query string — what an HTML form sends — a space is +. Everywhere else, including path segments, it is %20. Getting this backwards is the single most common URL bug, so both directions have a switch for it and the encoder marks which one is in use.
QDoes removing tracking parameters break the link?+
Almost never. utm_*, fbclid, gclid and their relatives are read by analytics, not by the page, so the destination is identical without them. The parameters that are sometimes genuine — ref, source, s — are kept by default and only removed if you tick the aggressive option.
QWhat does the punycode line under the hostname mean?+
Browsers convert international domain names to an ASCII form beginning with xn-- before sending them. URLBolt converts that form back so you can read it, and warns you when a single label mixes writing systems — that is how a Cyrillic а gets passed off as the Latin one in a lookalike domain.
QIs anything sent to a server?+
No. Encoding, decoding, parsing, punycode conversion and batch cleanup are all native browser APIs running in your tab. There is no network request at any point, so the tool works offline once the page has loaded.