DocomintCodificador / decodificador de URL
Codifique ou decodifique URLs e strings de consulta instantaneamente.
Just need standard %-encoding for a query string? Stay here. Need an unreadable, tamper-proof shareable link instead? Switch to Secret URL.
Escapes everything unsafe for a single value — use this for one query param or path segment, not a whole URL.
What is a Codificador / decodificador de URL?
URLs can only safely contain a limited set of characters — spaces, ampersands, and non-ASCII characters all need percent-encoding before they're safe inside a query string or path segment, or a URL with unencoded special characters will parse incorrectly, or break entirely, in the receiving system. Three encoding modes cover the cases a single blanket encoder gets wrong: Component for one value going inside a larger URL, Full URI for a whole URL whose own structure should survive intact, and Strict for consumers that require every RFC 3986 reserved character escaped. A separate Secret URL mode does something different: it encrypts a whole URL with AES-256-GCM, keyed by a passphrase you choose, and turns it into a shareable, unreadable Docomint link that only decrypts — locally, in the recipient's browser — with that same passphrase. The passphrase itself is never part of the link, so it has to reach the recipient a different way (a call, a separate message); that's what makes the link genuinely undecryptable without it, rather than merely hard to read.
How to use the Codificador / decodificador de URL
- Paste a URL, query parameter, or text fragment — or switch to the Secret URL tab to encrypt a whole URL instead
- Percent-encode/decode instantly, or set a passphrase and generate an AES-256-GCM encrypted link — both happen on your device
- Copy the result, or share the encrypted Secret URL link plus its passphrase (separately) — the original URL is never uploaded
Example
Encoding search query=hello world & more in Component mode turns it into search%20query%3Dhello%20world%20%26%20more, escaping the & and = along with the space. Encoding the full URL https://example.com/search?q=hello world in Full URI mode instead only escapes the space, leaving ://, ?, and = intact so the URL still parses. In Secret URL mode, encrypting that same URL with a passphrase instead produces something like https://docomint.com/en/tools/url-encoder#v1.8Fh2K9xP... — unreadable until someone enters the matching passphrase, and not decryptable by a plain Base64 or URL decoder even with the link in hand.
Frequently asked questions
Is my data uploaded anywhere?
No — Codificador / decodificador de URL runs entirely in your browser using JavaScript/WebAssembly. Your data is never sent to a server.
Should I use this on a whole URL or just one query parameter's value?
For a single value being embedded inside a larger URL, like a search term, use Component mode and encode just that value — encoding the whole URL in Component mode would also escape its own \"://\", \"?\", and \"&\" separators, breaking the URL's structure. To encode a complete URL and keep it working, switch to Full URI mode instead, which leaves those structural characters alone.
Does this handle non-ASCII characters, like accented letters or emoji?
Yes, in every mode — non-ASCII characters are UTF-8 encoded first, then percent-encoded byte by byte, the same behavior as a browser's own encodeURIComponent/encodeURI.
What's the difference between Component, Full URI, and Strict mode?
Component escapes everything unsafe for a single value, including : / ? & = — correct for one query parameter or path segment. Full URI (encodeURI) leaves those same URL-structure characters alone so a complete URL round-trips without its separators being mangled. Strict adds RFC 3986's reserved sub-delimiters — ! ' ( ) * — on top of Component encoding, for consumers (like signed request URLs) that require every reserved character escaped, which JavaScript's built-in encodeURIComponent leaves untouched by default.
Is Secret URL mode the same as normal URL encoding?
No. Percent-encoding (the Component/Full URI/Strict modes) is reversible by anyone with a standard URL decoder — it's not meant to hide anything. Secret URL mode uses authenticated encryption (AES-256-GCM) instead, so the result doesn't decode with a URL or Base64 decoder — it requires running it back through this tool's decryption.
Does Docomint store or see the URL I encrypt?
No. Encryption happens entirely in your browser using a key derived from a passphrase you set, and the encrypted result is only ever shared as part of the URL you copy — Docomint's servers don't receive, log, or store the original URL, the passphrase, or the encrypted link. Because the passphrase is never included in the link and Docomint never sees it, nobody without it can decrypt the link — including Docomint.
How should I share the passphrase for a Secret URL?
Through a different channel than the link itself — say it on a call, send it in a separate message, or share it in person. If the passphrase travels alongside the link (the same email, the same chat thread), anyone who intercepts one likely has the other too, which defeats the point of encrypting the URL in the first place.
What happens if I forget the passphrase?
The URL can't be recovered. There's no password reset — Docomint never receives or stores the passphrase, so there's nothing on any server to recover it from. You'd need to encrypt the URL again with a new passphrase.
What happens if someone modifies a Secret URL link?
Decryption fails outright. AES-GCM authenticates the encrypted data, so even a single changed character is detected and rejected rather than silently producing a corrupted or wrong URL — the same happens if someone tries the wrong passphrase.
Is a generated Secret URL link permanent?
There's no database record for Docomint to delete or expire — the link stays decryptable for as long as this tool's encryption format keeps supporting it and you still have the passphrase, with no separate storage lifetime to track.