# URL Encoder / Decoder

URL: https://phishdestroy.io/developer-tools/url-encoder-decoder
Category: Phishing URL & domain
Where it runs: Runs locally (nothing you enter is uploaded)

Decode percent-encoded text, such as a redirect target hidden in a phishing link, or encode text for use in a URL with encodeURIComponent or encodeURI.

## Example input

Encoded redirect target

```
https%3A%2F%2Flogin.example.com%2Fverify%3Fuser%3Dalice%40example.com%26step%3D2
```

Decode gives https://login.example.com/verify?user=alice@example.com&step=2. Phishing links often carry the recipient's email address like this so the fake login page can fill it in.

## FAQ

### What is the difference between the three buttons?

encodeURIComponent escapes everything except letters, digits and a few marks such as - _ . ~, so it suits a single parameter value. encodeURI keeps URL structure such as : / ? & = # intact, and decode reverses %XX sequences.

### Why does decoding show Error or leave %2F behind?

A malformed sequence such as a lone % or a cut-off %E0%A4 makes decoding fail, and the tool shows Error. It removes one layer per run, so double-encoded text (%252F) needs a second pass or Multi-Layer Decoder, and + is not turned into a space.

### Is the text sent anywhere?

No. Encoding and decoding use the browser's built-in functions on this page; nothing is uploaded and no link is opened.

## Related tools

- [URL Parser](https://phishdestroy.io/developer-tools/url-parser)
- [Link Unwrapper](https://phishdestroy.io/developer-tools/link-unwrapper)
- [Multi-Layer Decoder](https://phishdestroy.io/developer-tools/multi-layer-decoder)
- [Base64 Encoder / Decoder](https://phishdestroy.io/developer-tools/base64-encoder-decoder)
- [HTML Escape / Unescape](https://phishdestroy.io/developer-tools/html-entity-encoder)

All tools: https://phishdestroy.io/developer-tools