URL Decode

How URL Decoding Works

Decoding is a simple scan. The decoder walks the string one character at a time and copies everything straight through until it meets a percent sign. At that point it reads the next two characters, interprets them as a hexadecimal byte value, and writes that byte to the output. When the scan is finished, the collected bytes are interpreted as UTF-8 text.

That last step matters for non-ASCII content. Characters outside ASCII were encoded as several bytes, so %E2%82%AC is not three separate characters but one euro sign assembled from three consecutive escape sequences. A decoder that handles each escape in isolation produces mojibake.

Worked Example

Why Decoding Fails

• Malformed sequences. %ZZ or %G1 are not hexadecimal, so the decoder throws. In JavaScript this surfaces as a URIError from decodeURIComponent.
• Truncated escape. A percent sign at the very end of the string, or followed by only one character, has nothing to read.
• Literal percent signs.Text like "50% off" that was never encoded will break a decoder, because %20 is read as an escape sequence. A literal percent must always be written as %25.
• Invalid UTF-8. Byte sequences that do not form valid UTF-8, often because the value was encoded in Latin-1, decode to replacement characters.

The Plus Sign Problem

Form submissions encode a space as a plus sign, but decodeURIComponent implements RFC 3986 and knows nothing about that convention. Feed it form data and every space comes back as a literal plus.

Beware of doing the replacement blindly. If the value legitimately contains a plus sign, for example a phone number or an email address with a plus tag, and it was correctly encoded as %2B, that escape survives the naive replace and decodes back to a plus. But a raw plus that was never meant as a space will be destroyed.

Double Encoding and How to Spot It

Double encoding happens when a value passes through two encoding steps, typically because one layer of a system encodes defensively and another does it again. The signature is a percent sign followed by 25, since the percent sign of the first escape gets encoded on the second pass.

The correct fix is to remove the duplicate encoding step, not to decode twice in the consumer. Blind repeated decoding is a known security hazard: filters that inspect a URL once but a downstream component decodes twice have been the root cause of path traversal and access control bypasses.

Percent-Encoding Reference Table

These are the characters you meet most often when working with query strings, path segments, and form data. Each one is replaced by a percent sign followed by the two hexadecimal digits of its byte value.