Phishing URL & domain

URL Encoder / Decoder

Runs locally

Use URL Encoder / Decoder

What it does

Decode percent-encoded text, such as a redirect target hidden in a phishing link, or encode text for use in a URL with encodeURIComponent or encodeURI.

It runs entirely in your browser: nothing you enter is uploaded.

Example

Encoded redirect target

Input
https%3A%2F%2Flogin.example.com%2Fverify%3Fuser%3Dalice%40example.com%26step%3D2
Output (captured 2026-10-20)
https://login.example.com/verify?user=alice@example.com&step=2

Decode gives https://login.example.com/verify?user=alice@example.com&step=2. Phishing links often carry the recipient's email address like this so the fake login page can fill it in.

FAQ

What is the difference between the three buttons?

encodeURIComponent escapes everything except letters, digits and a few marks such as - _ . ~, so it suits a single parameter value. encodeURI keeps URL structure such as : / ? & = # intact, and decode reverses %XX sequences.

Why does decoding show Error or leave %2F behind?

A malformed sequence such as a lone % or a cut-off %E0%A4 makes decoding fail, and the tool shows Error. It removes one layer per run, so double-encoded text (%252F) needs a second pass or Multi-Layer Decoder, and + is not turned into a space.

Is the text sent anywhere?

No. Encoding and decoding use the browser's built-in functions on this page; nothing is uploaded and no link is opened.