URL Decoder

Reading percent-encoded URLs

Links copied from analytics reports, server logs, redirect chains and email campaigns are often full of %20, %3D and %C3%A9. URL decoding reverses percent-encoding: each %XX is turned back into a byte, and byte sequences are reassembled into UTF-8 characters, so caf%C3%A9 reads as café again.

This decoder goes further than decodeURIComponent, which simply throws "URIError: malformed URI sequence" on the first problem. It tells you what is wrong and where — a % without two hex digits, or bytes that are not valid UTF-8 (typical of text encoded as Latin-1) — and offers a lenient mode that decodes everything it can while leaving the bad sequences untouched.

Paste a complete URL and you also get a breakdown: protocol, host, port, decoded path, fragment and a table of every query parameter with its decoded value. Parameters that are still encoded after one pass, such as a redirect= URL that was encoded twice, are flagged.

How to use the URL Decoder

1. Paste the encoded string or full URL into the input box, or click Sample to see a URL with a double-encoded redirect parameter.
2. Keep Treat + as a space on for query strings and form data; turn it off when decoding paths, where + is a literal plus.
3. If the result still contains %XX sequences, enable Decode repeatedly to unwrap double or triple encoding.
4. If you get a malformed-sequence error, fix the input at the marked position or choose Decode leniently. Copy the result or read the parameters in the URL breakdown.

Example

A redirect parameter that was encoded twice: one pass leaves it encoded, repeated decoding recovers the original URL.

Input:    next=https%253A%252F%252Fexample.com%252Fcart%253Fid%253D7
1 pass:   next=https%3A%2F%2Fexample.com%2Fcart%3Fid%3D7
2 passes: next=https://example.com/cart?id=7

Why URLs end up double-encoded

Double encoding happens when already-encoded text is encoded again, so % itself becomes %25: %20 turns into %2520. It is common with redirect and callback parameters that pass a URL inside another URL, with tracking links rewritten by email platforms, and with code that encodes values both when building a URL and again in an HTTP client. Decoding repeatedly is fine for reading such URLs, but fix the code that encodes twice rather than decoding twice on the server — repeated decoding can also turn harmless input into path traversal (%252e%252e%252f → ../), which is why security filters must decode exactly once.

Malformed sequences explained

• `%` not followed by two hex digits, as in 100% or %G1: the literal percent sign should have been encoded as %25.
• Invalid UTF-8, as in caf%E9: the text was encoded as Latin-1 / Windows-1252, where é is the single byte E9. Modern URLs must use UTF-8 (%C3%A9).
• A multi-byte character cut in half, as in %E2%82: the URL was truncated, often by a length limit in a log or a database column.