Skip to content
100% local

URL link obfuscator

Rewrite a URL into a percent-hex escaped form that still works when clicked.

Input
Output

URL link obfuscator

Paste a normal link and this tool rewrites it into a percent-hex escaped version — every character of the domain (or the whole URL, if you switch the option) becomes its %XX code, the same way a space becomes %20. "example.com" turns into something like "%65%78%61%6d%70%6c%65%2e%63%6f%6d": unreadable at a glance to a person skimming a chat message or a spreadsheet, and to a simple pattern-matching bot that only looks for plain hostnames or keyword blocklists.

The result stays a real, working link. Browsers decode percent-escaped hostnames before resolving them, and decode escaped characters in a path or query string as part of an ordinary request, so pasting the obfuscated URL into an address bar — or using it as an href — takes you to exactly the same destination as the original. "Domain only" is the default and obfuscates just the hostname, which is the part people actually read to judge where a link goes; "Full URL" also scrambles the path, query values and fragment, while keeping the slashes, "?", "#", "=" and "&" intact so the link structure still parses correctly.

This is obfuscation, not encryption or a security control — anyone can paste the result into this tool's own URL decoder, or run decodeURIComponent in a browser console, and get the plain link straight back. Treat it as a way to keep a destination from being obvious in a quick glance or a naive automated scan (in a puzzle, a demo, or content where you don't want the raw domain visible), not as a way to hide something from a person or system that's actually looking.

Everything runs in your browser. The URL you paste is never uploaded anywhere, and the conversion happens instantly as you type, with a live count of how many characters got escaped shown under the output.

FAQ

Will the obfuscated link still work if I click it?
Yes. Browsers decode percent-escaped characters in the hostname before resolving it, and in the path or query as part of a normal request, so the obfuscated URL opens the same destination as the original.
What's the difference between "Domain only" and "Full URL"?
"Domain only" (the default) escapes just the hostname — the part most people read to judge a link's destination. "Full URL" also escapes the path, query values and fragment, while keeping the structural /, ?, #, = and & characters literal so the URL still parses correctly.
Does this actually hide the destination from anyone?
No — it's obfuscation, not encryption. Anyone can decode the result with this tool's URL decoder or a single line of JavaScript. It only defeats a glance or a naive bot pattern match, not a determined look.
Can it handle domains with accented characters?
Yes. A domain like "café.com" is first converted to its ASCII punycode form (the way browsers already represent it internally), then that form is percent-escaped.
Is my URL uploaded anywhere?
No. The conversion runs entirely in your browser and the link never leaves your device.