URL Decode Online – Decode Percent-Encoded URLs

How the URL Decoder works

The decoder replaces each %XX sequence with the byte it stands for, then reads consecutive bytes as UTF-8, so %C3%A9 becomes é. Upper- and lower-case hexadecimal digits are both accepted. Everything else is copied unchanged.

A % that is not followed by two hexadecimal digits is malformed. Instead of failing silently, the tool reports its position and what it found, so you can fix it (a literal percent sign is written %25). Bytes that do not form valid UTF-8 are replaced with � and the message tells you where the first one is.

A + means a space only in HTML form data and query strings, so it is kept as + unless you tick Treat + as a space. When the input is a URL or a query string (such as a=1&b=2), its query parameters are also listed in a table. Each name and value is split on & and = before it is decoded, so an encoded %26 inside a value does not split it.

How to use the URL Decoder

Paste the encoded URL, query string or text into the input box, or select Load example.
Tick Treat + as a space if the text comes from a query string or an HTML form submission.
Select URL decode, or press Ctrl + Enter (Cmd + Enter on a Mac).
Copy or download the decoded text. If the input is a URL or query string, review the Query parameters table below the tool.

Example

This URL:

https://www.example.com/search?q=caf%C3%A9+cr%C3%A8me&category=Food%20%26%20Drink&price=%E2%82%AC10-%E2%82%AC20

is decoded (without Treat + as a space) as:

https://www.example.com/search?q=café+crème&category=Food & Drink&price=€10-€20

and the query parameter table shows q = café crème, category = Food & Drink and price = €10-€20. The input 100% is reported as Malformed percent-encoding at position 4: "%" must be followed by two hexadecimal digits, but found "%" at the end of the input.

Common use cases

Reading tracking links and redirect URLs full of %3A%2F%2F sequences.
Inspecting the query parameters of a request copied from server logs or browser developer tools.
Decoding form-encoded POST bodies captured in a proxy or debugger.
Finding the malformed % sequence that makes a web server return 400 Bad Request.
Recovering file names and search terms with non-English characters from URLs.

Common errors and how to fix them

Malformed percent-encoding at position N: A % must be followed by exactly two hexadecimal digits. Either a literal percent sign was never encoded as %25, or the value was cut off part-way through a sequence.
Spaces decoded as + signs, or plus signs vanished: Two conventions exist: %20 inside URL paths, and + inside form data sent as application/x-www-form-urlencoded. Choose the mode that matches where the value came from.
Decoding once still leaves %25 or %2520 in the text: The value was encoded twice, which happens when a URL passes through two systems that each encode it. Decode a second time to recover the original.
Non-English characters decode to garbled symbols: Percent-encoded bytes are interpreted as UTF-8. If the system that produced the value used a different character set, the bytes cannot be reconstructed correctly here.

Frequently asked questions

Why is + not decoded as a space by default?

Outside query strings and form data, + is a literal plus sign, and turning it into a space would change values such as phone numbers or Base64 strings. Tick Treat + as a space when you decode query strings or form bodies. The query parameter table always reads + as a space, as browsers do for form data.

What does "Malformed percent-encoding" mean?

Every % must be followed by two hexadecimal digits (0–9, A–F). The message gives the position of the % and what follows it, such as %G1 or a % at the end of the input. A literal percent sign should have been encoded as %25.

What happens to bytes that are not valid UTF-8?

They are replaced with the � replacement character, and the status message says how many there were and where the first one is. This usually means the URL was encoded with a legacy character set such as Windows-1252.

When is the query parameter table shown?

When the input is a single line that contains a ? (a full or relative URL) or looks like a query string such as a=1&b=2. Each parameter is split on & and = before it is decoded, so an encoded %26 or %3D inside a value stays part of that value.

Is my URL sent to your server?

No. Decoding runs in your browser, so URLs containing tokens or personal data stay on your device.