diff --git a/url-encode-password.sh b/url-encode-password.sh
new file mode 100755
index 0000000..d8714ea
--- /dev/null
+++ b/url-encode-password.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+# url-encode-password.sh — URL-encode a password for use in an RTSP (or any) URL.
+#
+# Runs entirely locally.  The password is read without echoing, never written
+# to disk, never sent anywhere.  The encoded result is printed to stdout so
+# you can copy it straight into your .env file.
+#
+# Usage:
+#   ./url-encode-password.sh
+
+printf 'Password (not echoed): '
+read -rs password
+echo   # newline after silent input
+
+# Pass via environment variable — avoids any shell quoting / injection issues.
+encoded=$(PASSWORD="$password" python3 -c "
+import os, urllib.parse
+print(urllib.parse.quote(os.environ['PASSWORD'], safe=''))
+")
+
+echo "URL-encoded: $encoded"
+echo ""
+echo "Paste into .env like:"
+echo "  CAM_RTSP_<cam>='rtsp://admin:${encoded}@192.168.1.XXX:554/stream1'"