diff --git a/url-encode-password.py b/url-encode-password.py
new file mode 100755
index 0000000..f7f2c7b
--- /dev/null
+++ b/url-encode-password.py
@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+"""URL-encode a camera password for use in an RTSP URL.
+
+Runs entirely locally.  The password is read without echoing via
+getpass — never written to disk, never sent anywhere.
+"""
+
+import getpass
+import urllib.parse
+
+password = getpass.getpass("Password (not echoed): ")
+encoded  = urllib.parse.quote(password, safe="")
+
+print(f"\nURL-encoded: {encoded}")
+print( "\nPaste into .env like:")
+print(f"  CAM_RTSP_<cam>='rtsp://admin:{encoded}@192.168.1.XXX:554/stream1'")
diff --git a/url-encode-password.sh b/url-encode-password.sh
deleted file mode 100755
index d8714ea..0000000
--- a/url-encode-password.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/bash
-# url-encode-password.sh — URL-encode a password for use in an RTSP (or any) URL.
-#
-# Runs entirely locally.  The password is read without echoing, never written
-# to disk, never sent anywhere.  The encoded result is printed to stdout so
-# you can copy it straight into your .env file.
-#
-# Usage:
-#   ./url-encode-password.sh
-
-printf 'Password (not echoed): '
-read -rs password
-echo   # newline after silent input
-
-# Pass via environment variable — avoids any shell quoting / injection issues.
-encoded=$(PASSWORD="$password" python3 -c "
-import os, urllib.parse
-print(urllib.parse.quote(os.environ['PASSWORD'], safe=''))
-")
-
-echo "URL-encoded: $encoded"
-echo ""
-echo "Paste into .env like:"
-echo "  CAM_RTSP_<cam>='rtsp://admin:${encoded}@192.168.1.XXX:554/stream1'"