webtools

URL Decode

Private: nothing leaves your browser

Result
output

                  

Waiting for text

Paste percent encoded text and read it back in plain language. It decodes as you type, and a whole URL also gets pulled apart into its host, path and every query parameter, each one decoded on its own.

About decoding a URL

Percent encoding is how a URL carries characters it cannot spell directly: a space becomes %20, an ampersand in someone's company name becomes %26, a rupee sign becomes %E2%82%B9. It is why a link you were sent turns into a wall of hex, and why a redirect parameter with a whole URL inside it becomes unreadable. Decoding puts it back.

Paste a complete URL and this does more than unescape it. The breakdown underneath lists the scheme, host and path, then every query parameter with its value decoded, which is usually the quickest way to find the one parameter you actually care about in a long tracking link. Nested encoding is common in redirect chains: decode, look at the parameter, then press Result to input to peel off the next layer. A value that is still unreadable once the percent escapes are gone is very often Base64, which the Base64 decoder will open.

One difference matters. Text that came out of an HTML form uses a variant where a space is a plus sign rather than %20. If your input came from a search box or a form submission, tick Treat + as a space, otherwise the plus signs stay exactly as they are, which is correct everywhere else.

How to decode a URL

  1. Paste the encoded text or the whole URL. The decoded version is already there.
  2. The direction is worked out from what you paste, so plain text gets encoded instead. Use Encode or Decode to overrule it.
  3. Tick Treat + as a space for anything copied out of a form or a search box.
  4. Read the parts underneath to pick a single parameter out of a long URL.
  5. Press Result to input to decode one more layer of a nested redirect.

Common questions about URL decoding

Does a link with a session token in it get sent anywhere?

No. The decoding and the breakdown both happen in JavaScript on this page, so a link with a session token or a customer reference in it stays on your device. Nothing is sent, logged or saved.

Why does a space sometimes come back as a plus sign?

Because HTML form submission uses a slightly different encoding from the rest of a URL: in application/x-www-form-urlencoded a space is written as a plus. Percent encoding proper uses %20. Tick Treat + as a space and the plus signs become spaces; leave it off and they stay, which is right for a path or a normal link.

What does "not a valid percent escape" mean?

A percent sign has to be followed by two hex digits. If the text contains a literal percent that was never encoded, such as "100% sure", there is nothing valid to decode and the status line points at the offending fragment. The fix is usually to encode that percent sign as %25 at the source.

Why is my text still encoded after decoding once?

It was encoded twice, which happens whenever a URL is put inside another URL as a parameter: %2520 is an encoded %20. Decode, then press Result to input and decode again. Each pass removes one layer.

Does it handle non-English characters?

Yes. Percent escapes carry UTF-8 bytes, so Hindi, Gujarati, emoji and accented letters all come back correctly, including the multi-byte sequences that look like several escapes in a row. A single character can legitimately be three or four escapes long.

Next

Related tools

All Dev tools