URL Decode Online

Decode percent-encoded URLs

Try an example

Encoded URL / Text

Decoded

Runs locally · Safe to paste secrets
Decoded output...

What Is URL Decoding?

URL decoding (percent-decoding) is the reverse of URL encoding: it converts percent-encoded sequences back into their original characters. Every occurrence of a percent sign followed by two hexadecimal digits (%XX) is replaced by the byte that XX represents. Multiple consecutive encoded bytes are recombined to reconstruct the original UTF-8 character.

URL decoding is an everyday task for developers working with APIs, web scraping, log analysis, and authentication flows. Encoded URLs are readable to machines but opaque to humans — decoding them instantly reveals the actual paths, search queries, redirect targets, and parameter values that would otherwise require mental hex-to-character conversion.

Why Use This Tool?

Quickly make sense of any percent-encoded URL or query string — no browser console required, nothing sent to a server.

Instant Decoding
Paste any encoded URL or parameter and see the human-readable version immediately. Great for debugging API requests and log files.
🛡️
Error Recovery
Falls back to legacy unescape() for inputs that contain old-style percent-encoded Latin-1 characters that would fail decodeURIComponent.
🔒
Client-side Only
All decoding runs locally in your browser. Tokens, passwords, and private query parameters never leave your device.
🔁
Full URL Support
Decode complete URLs or individual parameter values. The tool handles both standard %20 spaces and preserves + signs as literal plus characters.

How to Use This URL Decoder Online

No account, no installation. Paste your percent-encoded string into the input field and the decoded result appears instantly. Everything runs in your browser — your data never leaves your device.

  1. 1
    Paste Your Encoded URL or String
    Copy any percent-encoded string — a URL from a browser address bar, a query parameter from server logs, an API response, or a redirect target — and paste it into the input field.
  2. 2
    Automatic Format Detection
    The decoder automatically handles both %XX percent-encoding and + as space (application/x-www-form-urlencoded). No need to manually specify the encoding format.
  3. 3
    Inspect the Decoded Output
    The human-readable text appears instantly. If the input contained nested encoding (double-encoded strings), the decoder resolves one layer at a time. An error appears for malformed %XX sequences.
  4. 4
    Copy or Re-encode
    Click Copy to grab the decoded string. Need to encode it again with different settings? Switch to the URL Encoder tool with one click.

How Decoding Works

The decoder scans the input for % sequences, converts each two-hex-digit group to a byte value, groups consecutive byte sequences together, and interprets them as UTF-8 to produce the final Unicode characters.

Example
Input:https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dhello%20world
%3A:  %2F/  %3F?  %3D=  %20space
Output:https://example.com/search?q=hello world

Percent-encoded Character Reference

A quick-reference for the most frequently encountered percent-encoded sequences:

EncodedCharWhere you'll see it
%20spacepath segments, query values
%2B+literal plus (not a space in query)
%2F/slash inside a path component
%3F?literal question mark in a value
%23#literal hash in a value
%26&literal ampersand in a value
%3D=literal equals sign in a value
%40@at sign in username / password
%3A:colon inside a path segment
%25%literal percent sign
%2C,comma in path or query
%5B[opening bracket
%5D]closing bracket
%7B{curly brace in template literals
%7D}curly brace in template literals

Common Use Cases

Debugging API Requests
Copy a URL from browser DevTools network logs and decode it to see the actual query parameter values — especially useful when automated tools or libraries have percent-encoded the parameters.
Reading Log Files
Web server access logs and application logs store URLs in their encoded form. Decode them to find the real requested paths, search terms, and parameter values.
Inspecting Redirects
OAuth callbacks, SSO redirects, and link-tracking URLs often carry heavily encoded redirect_uri or next parameters. Decode the URL to trace the intended destination.
Parsing Webhook Payloads
Webhook bodies sent as application/x-www-form-urlencoded (Stripe, Twilio, GitHub) arrive as percent-encoded strings. Decode them to read the actual field values.
Extracting Search Queries
Analytics URLs and referrer headers contain the user's original search query percent-encoded in the q= parameter. Decode to display or analyze the actual search terms.
Reverse Engineering URLs
When integrating with third-party APIs or scraping, encountered URLs often contain encoded path segments and parameters. Decode them to understand the URL structure and reproduce requests.

Common Pitfalls

These are the most frequent mistakes when decoding percent-encoded strings:

Confusing + with %20
In application/x-www-form-urlencoded data (HTML form submissions), + represents a space. But in a raw URL path or a value encoded with encodeURIComponent, + is a literal plus sign. decodeURIComponent does not convert + to space — use URLSearchParams or unquote_plus for form data.
Double-encoded Strings
If a string was encoded twice, decoding once still leaves percent signs: %2520 decodes to %20, not a space. Decode a second time to get the original value. Watch for this in logs, proxies, and middleware that re-encodes already-encoded data.
Malformed Percent Sequences
A lone % or a % followed by non-hex characters (e.g. %GG or % 2) is invalid and will throw a URIError. Always validate input or wrap decoding in a try/catch.
Encoding Mismatch (Latin-1 vs UTF-8)
Old systems (PHP's urlencode, classic ASP) encoded characters as Latin-1 bytes. A string encoded as Latin-1 may decode incorrectly with a UTF-8 decoder. If you see garbled characters, try the legacy unescape() path or determine the original encoding.

Code Examples

How to URL-decode strings in popular languages and environments:

JavaScript (browser / Node.js)
// Decode a percent-encoded component
decodeURIComponent('hello%20world%20%26%20more') // → "hello world & more"

// Decode a full URL (leaves structure characters encoded)
decodeURI('https://example.com/path?q=hello%20world') // → "https://example.com/path?q=hello world"

// Parse a query string (handles + as space automatically)
const params = new URLSearchParams('q=hello+world&lang=en')
params.get('q') // → "hello world"
Python
from urllib.parse import unquote, unquote_plus, parse_qs

# Decode percent-encoded string
unquote('hello%20world%20%26%20more')   # → 'hello world & more'

# Decode form-encoded string (+ → space)
unquote_plus('hello+world%21')          # → 'hello world!'

# Parse full query string
parse_qs('q=hello%20world&lang=en')     # → {'q': ['hello world'], 'lang': ['en']}
Node.js (URL API)
const url = new URL('https://example.com/search?q=hello%20world%20%26%20more')
url.searchParams.get('q')  // → "hello world & more"
url.pathname               // → "/search"
CLI (bash)
# Decode with Python one-liner
python3 -c "from urllib.parse import unquote; print(unquote('hello%20world'))"

# Decode with Node.js
node -e "console.log(decodeURIComponent('hello%20world%20%26'))"

URL Decoder vs. Alternatives

Multiple tools can decode percent-encoded strings, but they differ in clarity, privacy, and convenience.

This Tool
Browser-based, instant, private. Handles %XX encoding, + as space, Unicode, and malformed sequences. No data sent to any server.
Browser Address Bar
Browsers decode URLs for display but not always completely — some encoded characters remain visible in the address bar. Not useful for inspecting individual parameter values.
DevTools / curl -v
Browser DevTools and curl show raw and decoded URLs in network requests. Useful for debugging but requires switching tools and knowing where to look.

Frequently Asked Questions

What is the difference between decodeURIComponent and decodeURI?
decodeURIComponent decodes all percent-encoded sequences including reserved characters (%2F → /, %3F → ?, etc.). decodeURI only decodes sequences that would not produce a character with special meaning in a URL — it leaves %2F, %3F, %23 and other structural characters encoded. Use decodeURIComponent for parameter values; use decodeURI only when you have a full URL and want to preserve its structure.
Why do I see URIError: malformed URI?
This error from decodeURIComponent occurs when the input contains a % not followed by two valid hex digits, or when a multi-byte UTF-8 sequence is incomplete (e.g. %E2 without the following %82%AC). Strip or escape stray percent signs before decoding.
Does decoding handle + as space?
No — decodeURIComponent treats + as a literal plus sign, not a space. The + → space convention only applies to application/x-www-form-urlencoded data (HTML form submissions). To decode form-encoded data, use URLSearchParams (browser/Node) or urllib.parse.unquote_plus (Python).
Is URL decoding safe to do client-side?
Yes — URL decoding is a pure transformation with no network requests. All modern browsers include decodeURIComponent and decodeURI as native functions. This tool performs decoding entirely in your browser; no data is sent anywhere.
How do I decode a URL that was encoded multiple times?
Decode it multiple times until the output stabilises (no more % sequences being resolved). This happens when an already-encoded URL is passed through another encoder. Each decode pass removes one layer of encoding.
What does %XX represent?
The two characters after % are hexadecimal digits representing a single byte value (00–FF). For ASCII characters, this byte is the character's ASCII code: %41 = 65 = 'A'. For non-ASCII characters, multiple %XX sequences represent the UTF-8 byte sequence of the character: the euro sign € is %E2%82%AC (three bytes: 0xE2, 0x82, 0xAC).
What encoding does a browser use when submitting HTML forms?
HTML forms with method=GET append inputs to the URL using application/x-www-form-urlencoded encoding, which replaces spaces with + instead of %20 and percent-encodes other special characters. The URL Decode tool's + → space option handles this format. Forms with method=POST and enctype=application/x-www-form-urlencoded use the same scheme in the request body.
Is there a size limit for decoding?
No server-side limit — the tool runs entirely in your browser. Practical limits depend on your browser's memory. For very large encoded strings or batch processing, use decodeURIComponent in a script.