What is a URL decoder?
A URL decoder converts percent-encoded text back into readable characters. Each % followed by two hex digits stands for one byte, so %20 becomes a space and %C3%A9 becomes é. You need it when reading query strings in server logs, redirect parameters, tracking links, or any URL that's hard to read because of escapes.
Percent-encoding is defined in RFC 3986. This tool decodes it with JavaScript's decodeURIComponent(), treating the bytes as UTF-8.
How to decode a URL
- Paste the encoded URL or query value into the input box.
- Click Decode.
- Read or copy the decoded text from the output panel.
If any escape in the input is broken, you'll get the error "Malformed percent-encoded sequence." and no output, rather than a partly decoded result.
Worked example
A marketing link often carries the destination URL as an encoded parameter. Decoding the parameter value:
https%3A%2F%2Fexample.com%2F%3Fq%3D1
gives:
https://example.com/?q=1
Non-ASCII characters are made of several bytes, which the decoder joins back together:
| Encoded | Decoded |
|---|---|
hello%20world |
hello world |
caf%C3%A9 |
café |
%E2%82%AC |
€ |
%F0%9F%91%8D |
👍 |
%25 |
% |
%2541 |
%41 |
a+b |
a+b |
The %2541 row shows double encoding. One pass turns %25 into % and leaves 41 alone, giving %41. Decode again and you get A.
Errors and how to fix them
| Input | Problem | Fix |
|---|---|---|
100% |
% not followed by two hex digits |
Write a literal percent sign as %25 |
%zz |
z isn't a hex digit |
Check for a typo or a truncated copy |
%C3 |
Incomplete UTF-8 sequence | The second byte (%A9 for é) is missing, often because the URL was cut off |
%FF |
Not valid UTF-8 | The text was probably encoded in Latin-1 or another legacy charset |
The last case comes up with old systems that encoded é as %E9 (one Latin-1 byte) instead of %C3%A9. That's valid percent-encoding, but it isn't UTF-8, so this decoder rejects it.
Plus signs and form data
When an HTML form is submitted with GET, browsers encode the fields as application/x-www-form-urlencoded, where a space becomes +. The WHATWG URL standard describes this format. This decoder doesn't treat + as a space, so fish+chips stays fish+chips. Replace the plus signs with spaces first if your input came from a form. A real plus sign in form data is sent as %2B, so it survives either way.
Things to check after decoding
- Look before you click. Decoding a suspicious link shows you where it really goes, for example a
redirect=parameter pointing to an unfamiliar domain. - Decoded text isn't sanitized. If you put decoded values into HTML or SQL in your own code, escape them for that context.
- Some parts may still be encoded another way. Parameters that look like long runs of letters and digits ending in
=are often Base64. Paste them into the Base64 decoder.
Related tools
- URL encoder: encode text for use in a URL.
- Base64 decoder: for Base64 values inside query strings and tokens.
- Find and replace: replace every
+with%20in a form-encoded string, then decode it here.
Last updated