URL Encode, Decode and Parse a Query String

What it does

Four ways to encode: a value as encodeURIComponent does, strictly by RFC 3986, a form body with + for a space, or a whole URL.
UTF-8 or Windows-1252, each line on its own or the whole text as one value.
Decodes with + as a space or as a plus, and keeps and lists a % that begins no escape.
Bytes that are not UTF-8 are named, with what they read as in Windows-1252 a click away.
Text encoded twice or more is caught, and every layer taken off on request.
A link taken apart: scheme, user, host, port, path, query and fragment, with a Punycode host written as its letters.
Query parameters as rows to edit, repeats and bare keys kept, rebuilt without touching what you did not change.
Tracking parameters (utm_, fbclid, gclid and more) removed in one click, and a link inside a link opened in turn.

How to use it

Pick Encode, Decode or Parse.
Paste the text or the link.
Choose how it is escaped, or read what the parser found.
Copy the result, or the rebuilt URL.

What it does not do

Opening the link or following its redirects: the page makes no requests, so a shortened link shows only the shortener’s address.
Charsets beyond UTF-8 and Windows-1252: each of the others, such as Shift_JIS, needs a table of its own.
A look-alike name written wholly in another script: telling one takes Unicode’s confusables table, so only a name that mixes Latin with another script is flagged.

Questions

Which one: encodeURIComponent or encodeURI?

For a value that goes inside a URL, encodeURIComponent, since it escapes & = / ? #; for a whole URL, which must keep them, encodeURI. The tool’s “A value” and “A whole URL” are those two, and the whole-URL mode also leaves escapes already there alone.

Is a space %20 or +?

Both, in different places. In a path it is %20, and + is a plus; in a query string and a form body a browser writes +, and servers read either there. Untick “+ is a space” to decode a path.

What does %2520 mean?

That the text was encoded twice: %25 is the percent sign itself, so one decode gives %20 and a second gives a space. The tool says how many layers it finds and takes them all off when asked.

Is this link safe to click?

The tool shows where it really goes: the host after any user name, a Punycode name as its letters, and a label that mixes Latin with look-alike letters. It cannot see what the page does, since it never opens it.

Often used with

Base64 Encode & Decode: the other encoding that URLs and tokens carry
JWT Decoder: a token found in a callback URL
QR Code Generator: the cleaned link as a QR code

More in Dev Tools

JSON Formatter: Format, validate, repair and explore JSON: tree view, sorted keys, and big numbers kept exactly.
Regex Tester: Test JavaScript regular expressions live: highlighted matches, capture groups, replace, and a plain-English explanation.
Hash Generator: Hash text or files with MD5, SHA-1, SHA-2, SHA-3, BLAKE3, CRC-32 and more; verify a checksum; compute an HMAC.
Unix Timestamp Converter: Turn Unix timestamps in seconds, milliseconds or nanoseconds into dates and back, many at once, with Excel, Windows and Discord times too.
Cron Expression Parser: Read a cron expression in plain English, see its next runs in any time zone and what a clock change does to them, or build one; Unix, Spring, Quartz and EventBridge.