How to decode a URL
- Paste the encoded value. A single parameter, a whole query string and a complete URL both work; line breaks in the paste are treated as ordinary text.
- Press Decode URL. Every valid
%XXsequence is replaced by the byte it represents, and characters that are not escaped are left exactly as they are. - Read the result. Path separators, parameter names and fragment markers reappear in place, so you can see what the original request contained.
- If the output still contains escapes such as
%20, decode once more: the string was double-encoded.
What URL decoding does
Percent-decoding is the inverse of percent-encoding. The decoder reads each %XX triple as one byte, collects the bytes, and interprets the resulting sequence as UTF-8 text. Everything that was not escaped passes through untouched, which is why decoding a full URL keeps its structure intact.
The output is only as correct as the input. If the bytes were produced from UTF-8, the text is exact. If they came from a legacy encoding such as GBK or ISO-8859-1, the byte sequence is not valid UTF-8 and no decoder can recover the original characters without knowing that legacy encoding. This tool reports that case as an error rather than replacing the characters with question marks.
Why URL decoding fails
- A percent sign without two hex digits. A valid escape is
%plus two hexadecimal characters, such as%20. A truncated copy, a literal percent sign, or text like100%produces this error. A real percent sign must be written%25. - Incomplete multi-byte sequences. One Chinese character takes three UTF-8 bytes, so
%E4on its own is an unfinished character. If an encoded value was cut in the middle of an escape group, the decoder says so instead of guessing. - Invalid byte sequences. Escapes can encode bytes that are not valid UTF-8 at all. Those strings were not produced from UTF-8 text, so decoding to readable characters is not possible without knowing the source encoding.
- Plus signs treated as spaces. JavaScript's
decodeURIComponentleaves+alone. In HTML form data a plus is a space, but in a URL path it is a literal plus, so silently converting it would be wrong. This decoder leaves plus signs as they are and adds a note to the result when it sees one.
Double-encoded URLs
A double-encoded URL is one where encoding was applied twice. A space becomes %20 the first time; encoding that result turns the percent sign into %25, so the final string contains %2520. Decoding once gives back %20, which still looks encoded, and decoding a second time gives the space.
This happens most often when a value is passed through a redirect parameter or an analytics wrapper: the inner URL is encoded by the page, then the whole parameter is encoded again by the framework. If your result still shows escapes after one pass, the fix is simply to decode again. This page handles one layer per click, so you can see each stage instead of collapsing them into a guess.
URL decoding in code
The common languages differ mainly in whether they treat + as a space. This table lists the standard decoding function and that behaviour.
| Language | Decode | Plus sign handling |
|---|---|---|
| JavaScript | decodeURIComponent(value) | Left as a literal plus |
| Python 3 | urllib.parse.unquote(value) | Left as a literal plus; unquote_plus turns it into a space |
| PHP | rawurldecode($value) | Left as a literal plus; urldecode() turns it into a space |
| Java | URLDecoder.decode(value, StandardCharsets.UTF_8) | Turns + into a space |
| Python 3 (form data) | urllib.parse.parse_qs(body) | Turns + into a space, as form encoding specifies |
Frequently asked questions
Does URL decoding turn + into a space?
Not by default. This tool uses RFC 3986 decoding, which leaves + as a literal plus and adds a note when it sees one. In application/x-www-form-urlencoded data, + does mean a space, so if you know the string came from an HTML form or a form-encoded API body, convert + to a space before decoding.
Why do I get an error instead of decoded text?
The escapes are either incomplete or do not form valid UTF-8. A trailing % or a value ending in %E4 is a truncated copy; a complete sequence that still fails was not produced from UTF-8 text. The message identifies which case you have, so you can go back to the source rather than guessing an encoding.
How do I decode a full URL safely?
Decoding only converts escapes back to characters; it does not open links or contact servers. Treat the result as untrusted data anyway, because a decoded link can point anywhere. If you plan to follow it, check the scheme and host before clicking, and never paste the output into a shell command.
What is the difference between URL decode and Base64 decode?
URL decoding interprets percent escapes and returns the original text or bytes; Base64 decoding interprets a 64-character alphabet and returns the original data. They are different formats, so a string is decoded correctly by one and rejected by the other. Use the one that matches how the value was produced.
Can I decode several values at once?
Yes, if they are all percent-encoded. Paste the whole line and the decoder processes every escape, leaving line breaks and the surrounding punctuation in place. If only part of the line is encoded, decode that part on its own so the escaped separators can be read correctly.