URL Decoder

How it works

Paste a percent-encoded URL or query-string value and the decoded text appears as you type. %20 turns back into a space, %3A into a colon, %2F into a slash, and multi-byte sequences such as %E2%82%AC into the character they encode, in this case the euro sign.

Decoding uses the browser's decodeURIComponent, so every escape is reversed, including the ones that structure a URL such as %3F and %26. That makes it the right tool for reading a redirect_uri, a returnTo parameter, or a logged request in which a whole address was encoded into a single value.

A plus sign is left as a plus by default. In HTML form submissions + stands for a space, but in a URL path and in most APIs it is a literal character, so turning it into a space would silently change the data. If the input came from a submitted form, tick Treat + as space and each + is read as a space while %2B still decodes to a plus.

Input with a malformed escape, such as a lone % or a truncated %E2, reports an error instead of returning corrupted text. A value that was encoded twice decodes one layer at a time: %2520 becomes %20 on the first pass. When the output still contains percent escapes the tool says so, and Decode again removes the next layer in one click.

Frequently asked questions

What does %20 mean in a URL?

It is the percent-encoded form of a space. The character's UTF-8 byte value is 0x20, and percent-encoding writes each byte as % followed by its two hex digits. By the same rule %3A is a colon, %2F a slash, and %3F a question mark.

Why does decoding fail with an invalid input error?

The input contains a percent sign that is not followed by two valid hex digits, or a multi-byte UTF-8 sequence that was cut short. A literal percent sign in text has to be encoded as %25.

Why is + not decoded into a space?

Only HTML form encoding uses + for a space. Everywhere else in a URL it is an ordinary character, so the decoder keeps it unless you ask otherwise. If your string came from a submitted form, tick Treat + as space before decoding.

How do I decode a URL that was encoded twice?

Decode it again. Double encoding turns % into %25, so %20 becomes %2520 and the first pass only gives back %20. The tool notices the leftover escapes and shows a Decode again button that feeds the output back in and removes the remaining layer.

Is it safe to decode a URL that contains an access token?

Yes. Decoding runs in your browser using the built-in decodeURIComponent function. The value is never sent to a server and never leaves your device.