URL Decode

How to decode a URL

1. Paste the encoded value. A single parameter, a whole query string and a complete URL both work; line breaks in the paste are treated as ordinary text.
2. Press Decode URL. Every valid %XX sequence is replaced by the byte it represents, and characters that are not escaped are left exactly as they are.
3. Read the result. Path separators, parameter names and fragment markers reappear in place, so you can see what the original request contained.
4. If the output still contains escapes such as %20, decode once more: the string was double-encoded.

Measured examples (9 November 2026)

Six rows were decoded with this tool on 9 November 2026, and the byte count is checked after decoding but before the bytes are read as UTF-8: %E4%BD%A0%E5%A5%BD (18 characters) becomes 你好 (2 characters, 6 bytes); Hello%2C%20world%21 (19) becomes Hello, world! (13); %2520 (5) becomes %20 (3) on the first pass and a space (1 character) on the second; a%20b%26c%3D%E4%B8%AD (21) becomes a b&c=中 (7 characters, 9 bytes); hello%2Bworld%20today (21) becomes hello+world today (17); and 100%25 (6) becomes 100% (4).

How the URL tools fit together

This page is the pillar for the URL collection: it decodes percent-encoded text back into readable words. Its partner, URL Encode, runs the same operation in the other direction and escapes a value before it goes into a link, a redirect parameter or an API request.

In practice the two pages are used as a pair. You decode a URL to see what a tracking link, a redirect or a query string actually contains, then encode the corrected value before putting it back into a link. Base64 is a related but different format: when a value looks like SGVsbG8= rather than Hello%20world, the Base64 collection starts at Base64 Decode.

What URL decoding does

Percent-decoding is the inverse of percent-encoding: each %XX triple is 1 byte, written as 3 characters, and the collected bytes are then interpreted as UTF-8. Everything not escaped passes through untouched, which is why decoding a full URL keeps its 5 structural parts — scheme, authority, path, query and fragment — in place.

The output is only as correct as the input. UTF-8 uses 1 to 4 bytes per code point, so 你 (E4 BD A0) needs all 3 of its bytes before it can be shown; 你好 is 6 bytes and 18 characters when encoded. If the bytes came from a legacy encoding such as GBK or ISO-8859-1, the sequence is not valid UTF-8 and no decoder can recover the original characters without knowing that encoding. This tool reports that case as an error instead of substituting 1 replacement character per bad byte.

Why URL decoding fails

• A percent sign without two hex digits. A valid escape is % plus exactly 2 hexadecimal characters (16 possible digits), such as %20. A truncated copy, a literal percent sign, or text like 100% produces this error; a real percent sign must be written %25 (3 characters).
• Incomplete multi-byte sequences. 你 takes 3 UTF-8 bytes, so %E4 alone is 1 byte of an unfinished character. If an encoded value was cut inside an escape group, the decoder says so instead of guessing; 18 characters are needed for a 2-character Chinese word like 你好.
• Invalid byte sequences. Escapes can encode any of the 256 byte values, including ones that never appear in UTF-8. Those strings were not produced from UTF-8 text, so no UTF-8 decoder can recover them without knowing the source encoding.
• Plus signs treated as spaces. JavaScript's decodeURIComponent leaves + alone. In HTML form data 1 plus means 1 space, but in a URL path a plus is a literal plus, so silently converting all of them would be wrong. This decoder leaves plus signs as they are and adds a note when it sees one.

Double-encoded URLs

A double-encoded URL is one where encoding was applied twice. A space becomes %20 (3 characters) the first time; encoding that result turns the percent sign into %25, so the final string contains %2520 (5 characters). Decoding once gives back %20 (3 characters), which still looks encoded, and decoding a second time gives the space (1 character).

This happens most often when a value is passed through a redirect parameter or an analytics wrapper: the inner URL is encoded once by the page, then the whole parameter is encoded again by the framework. If your result still shows escapes after one pass, decode a second time. This page handles 1 layer per click, so you can see each of the 2 stages instead of collapsing them into a guess.

URL decoding in code

The common languages agree on percent escapes and differ only on the plus sign. JavaScript's decodeURIComponent(value) leaves + alone (0 conversions). Python 3's urllib.parse.unquote(value) also leaves it, while unquote_plus maps 1 plus to 1 space. PHP's rawurldecode($value) leaves it and urldecode() maps 1 plus to 1 space. Java's URLDecoder.decode(value, StandardCharsets.UTF_8) maps 1 plus to 1 space. Python's urllib.parse.parse_qs(body) treats the body as form data and therefore also maps 1 plus to 1 space.

That is 5 library behaviours across 4 languages, and 2 of them are driven by the source data being a form body rather than a URL. If a value came from an HTML form, decode with the form-aware function; if it came from a path segment, use the plain one, or the literal plus in hello+world becomes a space by mistake.

Frequently asked questions