How URL Decoding Works
Paste percent-encoded text and choose the appropriate decoding mode. Decoding interprets encoded byte sequences as characters. It does not fetch or visit the URL, and a decoded string should still be treated as untrusted input.
Percent-Encoding Examples
%20 represents a space, %2F a slash and %26 an ampersand. Case in the hexadecimal digits is not significant. A literal percent sign is %25; repeated decoding can change meaning, so decode only the expected layer.
Decoding Query Strings and Unicode
UTF-8 sequences represent non-ASCII text. Form-encoded query strings may use plus for spaces, which is a different convention from ordinary URI decoding. Use URLSearchParams when parsing a complete query string in application code.
Malformed URL Encoding Errors
A percent sign needs two hexadecimal digits, and multi-byte sequences must be valid. Truncated input or mixed encodings can fail. Locate the malformed sequence before retrying rather than guessing missing bytes.
URL Decode vs Base64 Decode
URL decoding reverses percent escapes used in URI contexts. Base64 decoding reconstructs bytes from a different alphabet. Choose the decoder indicated by the protocol or source field, not just by how encoded the text looks.
More examples and technical details
How URL Decoding Works
Decoding is a simple scan. The decoder walks the string one character at a time and copies everything straight through until it meets a percent sign. At that point it reads the next two characters, interprets them as a hexadecimal byte value, and writes that byte to the output. When the scan is finished, the collected bytes are interpreted as UTF-8 text.
That last step matters for non-ASCII content. Characters outside ASCII were encoded as several bytes, so %E2%82%AC is not three separate characters but one euro sign assembled from three consecutive escape sequences. A decoder that handles each escape in isolation produces mojibake.
Worked Example
Why Decoding Fails
- Malformed sequences. %ZZ or %G1 are not hexadecimal, so the decoder throws. In JavaScript this surfaces as a URIError from decodeURIComponent.
- Truncated escape. A percent sign at the very end of the string, or followed by only one character, has nothing to read.
- Literal percent signs. Text like "50% off" that was never encoded will break a decoder, because %20 is read as an escape sequence. A literal percent must always be written as %25.
- Invalid UTF-8. Byte sequences that do not form valid UTF-8, often because the value was encoded in Latin-1, decode to replacement characters.
The Plus Sign Problem
Form submissions encode a space as a plus sign, but decodeURIComponent implements RFC 3986 and knows nothing about that convention. Feed it form data and every space comes back as a literal plus.
Beware of doing the replacement blindly. If the value legitimately contains a plus sign, for example a phone number or an email address with a plus tag, and it was correctly encoded as %2B, that escape survives the naive replace and decodes back to a plus. But a raw plus that was never meant as a space will be destroyed.
Double Encoding and How to Spot It
Double encoding happens when a value passes through two encoding steps, typically because one layer of a system encodes defensively and another does it again. The signature is a percent sign followed by 25, since the percent sign of the first escape gets encoded on the second pass.
The correct fix is to remove the duplicate encoding step, not to decode twice in the consumer. Blind repeated decoding is a known security hazard: filters that inspect a URL once but a downstream component decodes twice have been the root cause of path traversal and access control bypasses.
Percent-Encoding Reference Table
These are the characters you meet most often when working with query strings, path segments, and form data. Each one is replaced by a percent sign followed by the two hexadecimal digits of its byte value.
| Character | Encoded | Name |
|---|---|---|
| space | %20 | Space |
| ! | %21 | Exclamation mark |
| " | %22 | Double quote |
| # | %23 | Hash / fragment delimiter |
| $ | %24 | Dollar sign |
| % | %25 | Percent sign |
| & | %26 | Ampersand / parameter separator |
| ' | %27 | Apostrophe |
| ( | %28 | Left parenthesis |
| ) | %29 | Right parenthesis |
| * | %2A | Asterisk |
| + | %2B | Plus sign |
| , | %2C | Comma |
| / | %2F | Slash / path separator |
| : | %3A | Colon / scheme separator |
| ; | %3B | Semicolon |
| = | %3D | Equals / key value separator |
| ? | %3F | Question mark / query start |
| @ | %40 | At sign |
| [ | %5B | Left square bracket |
| ] | %5D | Right square bracket |
| newline | %0A | Line feed |
| tab | %09 | Horizontal tab |
Working on something related? Browse every free developer tool on the site, including a URL encoder, Base64 decoder, HTML decoder, and JSON formatter. Everything runs entirely in your browser, so nothing you paste is ever uploaded.
Standards and references
Frequently asked questions
How do I decode a percent-encoded URL?
Paste the encoded text in Decode mode; choose the mode that matches how it was encoded.
What does %20 mean?
It is the percent-encoded representation of a space.
Can I decode Unicode URL sequences?
Yes, when the percent escapes encode valid UTF-8.
Why does malformed percent encoding fail?
Incomplete escapes or invalid UTF-8 cannot be interpreted reliably and cause a decoding error.
Is the URL uploaded?
No. Input is processed in this browser tab and is not uploaded by the tool. Copy and download are actions you control; ordinary page analytics do not receive tool input.