URL Decoder (Percent-Decoding)

How to decode a URL

1. Paste the encoded text into Encoded URL or text.
2. Keep Treat + as space on for query strings and form data, and turn it off for paths or Base64 values.
3. If the result still contains %XX sequences, the status suggests it: tick Decode repeatedly.
4. For a log file or a column of values, tick Each line separately so every line is decoded on its own.
5. Pick a Charset if the source was not UTF-8, then Copy output.

When the input is a full URL, the table below the panes shows the scheme, host, decoded path, each query parameter on its own row, and the fragment. That is the quickest way to read a long tracking or redirect URL.

Examples

Double encoding

Each time an already encoded string is encoded again, every % becomes %25. So / turns into %2F, then %252F, then %25252F. It happens when a redirect URL is passed through several services, or when a framework encodes a value the code had already encoded.

To read such a string, decode until no escapes remain; Decode repeatedly does that and reports the number of rounds. To fix the cause, find the layer that encodes a second time. A legitimately nested URL, such as a next= or url= parameter holding another URL, needs exactly one extra layer and no more.

Email security gateways are a common source of such nesting. A Microsoft Defender Safe Links URL looks like https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fexample.com%2Freset%3Fid%3D42&data=…; paste it and the parameter table shows the real destination, https://example.com/reset?id=42, without you clicking anything.

Malformed escapes and legacy charsets

A % must be followed by exactly two hex digits. 100%, %zz or a URL cut off mid-escape is an error, and the decoder reports Broken escape at position N. JavaScript’s decodeURIComponent throws URIError: URI malformed in the same cases, while Python’s unquote leaves the sequence as it is.

The other source of errors is the charset. Percent-escapes are bytes, and %E9 alone is not valid UTF-8. Python decodes it as the replacement character, JavaScript throws. With Charset set to Windows-1252 or ISO-8859-1 it decodes to é. Shift_JIS, GBK, EUC-KR, KOI8-R and other legacy charsets are in the same list.

URL decoding in code

decodeURIComponent("a%20b%26c")                   // "a b&c"
new URLSearchParams("q=a+b%2Bc").get("q")          // "a b+c"

from urllib.parse import unquote, unquote_plus, parse_qs
unquote("caf%C3%A9")                     # 'café'
unquote("caf%E9", encoding="latin-1")    # 'café'
unquote_plus("q=a+b%2Bc")                # 'q=a b+c'
parse_qs("q=a+b%2Bc&tag=x&tag=y")        # {'q': ['a b+c'], 'tag': ['x', 'y']}

decodeURIComponent does not turn + into a space; URLSearchParams and unquote_plus do. Pick the one that matches how the string was produced. For encoding, see the URL encoder, and for Base64 that arrived through a URL, the Base64URL decoder.

FAQ