URL Decoder

Runs in browser Encoding

Decode %XX sequences and + signs, handle double-encoded input, and surface malformed sequences with their positions.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use URL Decoder

  1. Paste the encoded text, URL or query string.
  2. Turn on "Decode repeatedly" if the result still contains %XX.
  3. Review the query parameter table.
  4. Copy the decoded text.

URL Decoder features

  • Decodes %XX sequences with UTF-8 (Latin-1 fallback for invalid bytes)
  • Optional + → space conversion and repeated decoding for double-encoded input
  • Lists malformed sequences with their positions instead of failing
  • Parses query strings into a parameter table
  • Detects double encoding and reports the number of passes

URL Decoder example

Decode a redirect parameter

Input:

redirect=https%3A%2F%2Fapp.example.com%2Fhome%3Ftab%3D1

Output:

redirect=https://app.example.com/home?tab=1

Frequently asked questions about URL Decoder

What is double encoding?

Encoding an already-encoded value, so "%20" becomes "%2520". It happens when a URL is built from parts that were encoded separately. Enable "Decode repeatedly" to unwrap every layer; the tool also tells you when it detects it.

Why is a "%" left in the output?

A "%" that is not followed by two hex digits (for example "100%" or "%GZ") is malformed. JavaScript's decodeURIComponent would throw; this tool keeps the text as-is and lists the position so you can fix it.

Should "+" become a space?

Only in query strings and form bodies. Turn the option off when decoding a path, where "+" is a literal plus sign.

Why does the table of query parameters appear?

When the input contains "key=value" pairs, they are split on "&" and each key and value is decoded separately so you can read every parameter at a glance.

Technical notes

Consecutive %XX bytes are collected and decoded together as UTF-8, so multi-byte characters such as %D8%A7 (Arabic alef) come out correctly. Sequences that are not valid UTF-8 are decoded byte-by-byte as Latin-1 and flagged, and a "%" without two hex digits is preserved verbatim rather than throwing a URIError.