URL Decode: How to Decode Percent-Encoded URL Strings
Convert percent-encoded URL strings back to readable text. Ideal for debugging query parameters, redirect URLs, and encoded API endpoints.
Try the free online tool
Runs entirely in your browser — no signup, no uploads.
Percent-encoded URLs are safe for transmission but difficult to read. When you copy a URL from a browser address bar or an API response, it is often littered with %20, %2F, %3A, and other percent-encoded sequences that obscure the actual content. URL decoding converts those sequences back into their original characters so you can read and understand the URL.
Debugging API requests, understanding redirect chains, and inspecting webhook payloads all become much easier when you can quickly decode the percent-encoded segments. A URL like https://example.com/search?q=hello%20world%20%26%20goodbye is hard to parse at a glance, but decoding it instantly reveals the original query string.
This tool decodes any percent-encoded string in your browser without sending data to a server. Paste the encoded URL or query string and get the readable version immediately.
What Is URL Decoding?
URL decoding (also called percent-decoding) is the inverse of percent-encoding. It scans a string for % followed by two hexadecimal digits, converts each such sequence to the corresponding byte value, and then interprets the resulting bytes as a UTF-8 string to produce the original text.
The process is defined in RFC 3986 and is performed automatically by web browsers when displaying URLs in the address bar. However, when working with raw URL strings in logs, code, or API responses, you often need to decode them manually or programmatically.
URL decoding is generally safe to apply to a full URL, unlike encoding, which requires care to avoid modifying structural characters. Decoding simply replaces encoded sequences with their originals without changing the URL structure.
How to Use This Tool
Decoding a percent-encoded URL is a one-step process.
- 1
Paste the encoded URL or string
Copy the percent-encoded URL, query string, or individual parameter value from your browser, log file, or API response.
- 2
Click Decode
The tool processes all %XX sequences and replaces them with their original characters.
- 3
Read the decoded output
Review the human-readable URL or string in the output field.
- 4
Copy the result
Use the Copy button to copy the decoded string for use in documentation, debugging notes, or further processing.
Common Use Cases
URL decoding is a frequent task in web development and API debugging.
- Decoding redirect destination URLs embedded as query parameters (e.g., ?returnUrl=%2Fdashboard%2Fsettings).
- Reading query parameters in server access logs that are stored in percent-encoded form.
- Inspecting webhook payloads and form submission data received as application/x-www-form-urlencoded.
- Debugging OAuth flows where redirect_uri and state parameters are percent-encoded.
- Decoding encoded file paths in REST API endpoints to understand which resource is being requested.
- Translating encoded email links to find tracking parameters or UTM codes.
Tips and Best Practices
- Decode URLs only once; if you apply URL decoding multiple times to a double-encoded string, you may get unexpected results.
- When decoding query strings, split on & and = before decoding each key and value individually to avoid misinterpreting encoded & or = characters in values.
- Use the browser console function decodeURIComponent() for quick one-off decoding without leaving your development environment.
- Be cautious when displaying decoded URLs from untrusted sources; a decoded string may contain HTML or script injection payloads that were hiding in the encoded form.
- In server-side code, rely on your framework's built-in query string parser rather than manually decoding; it handles edge cases like encoding inconsistencies and form-encoded + spaces.
Frequently Asked Questions
What is the difference between decodeURI() and decodeURIComponent() in JavaScript?
decodeURIComponent() decodes all percent-encoded sequences, including characters like /, ?, #, and & that are structurally meaningful in a URL. decodeURI() leaves those structural characters encoded, making it safer for decoding a complete URL without altering its structure. Use decodeURIComponent() for individual parameter values.
Why does %2B decode to a plus sign but + also means a space?
This is a common source of confusion. In RFC 3986 URLs, + is a literal plus sign and space is encoded as %20. In HTML form encoding (application/x-www-form-urlencoded), + represents a space. If you are decoding a form-encoded string, replace + with a space before standard percent-decoding.
Can URL decoding produce malicious output?
Yes. A percent-encoded string might hide characters that, once decoded, form a cross-site scripting (XSS) payload, a SQL injection string, or a path traversal sequence like ../. Always sanitise and validate decoded values before using them in database queries, file paths, or HTML output.
What happens if a percent-encoded sequence is invalid (e.g., %GG)?
Invalid sequences (where the two characters after % are not valid hexadecimal digits) are treated differently by different decoders. Some leave the invalid sequence as-is, others throw an error, and some replace it with a replacement character. This tool leaves invalid sequences unchanged to make them visible.
How do I decode a URL in Python?
Use urllib.parse.unquote(encoded_string) for standard URL decoding, or urllib.parse.unquote_plus(encoded_string) to also convert + characters to spaces (HTML form encoding). The requests library handles this automatically when you access response.url.
Why does my decoded URL contain strange characters instead of the expected text?
The source encoding might not be UTF-8. Older systems sometimes percent-encoded URLs using ISO-8859-1 or Windows-1252. If you see garbled characters, try interpreting the decoded bytes with a different character encoding.
Ready to use this tool?
Free, instant, no account required. Runs entirely in your browser.