URL decoder

Decoding tells you what a link really does

Percent-encoding hides structure. A tracking link, an OAuth redirect or a ?next= parameter is usually a URL inside a URL inside another URL, and the only way to read it is to decode it — often more than once.

If the result still contains %25, that is an encoded %, which means the text was encoded twice. Decode again.

The + question

application/x-www-form-urlencoded — what an HTML form sends — represents a space as +, not %20. Everywhere else, + is a literal plus sign.

Nothing in the string tells you which you have. So there is a switch:

• Decoding a query string from a form, turn it on.
• Decoding a path, or anything containing an email address or a base64 value, leave it off. Base64 uses + as a real character, and turning those into spaces corrupts the data silently.

When it will not decode

A percent sign must be followed by exactly two hexadecimal digits. 50% off is not valid percent-encoding, and neither is a sequence cut short by a line break.

Rather than a bare “URI malformed”, the message here names the escape that broke it — usually enough to see immediately that the text was truncated, or that a literal % was never encoded in the first place.

Escapes that are individually well-formed can still fail as a group if they do not spell valid UTF-8. That normally means the text was encoded in some other character set, and there is nothing to recover from the fragment.

Nothing is uploaded

Decoded in this page, on your machine. Encoded URLs frequently carry session tokens and signed parameters, and pasting one into a remote decoder hands those over.