How URL decoding works
Decoding scans for %HH groups and converts each pair of hex digits back to a byte. The resulting byte sequence is then read as UTF-8. So hello%20world becomes hello world, and %C3%A9 becomes a single accented e rather than two odd characters. Characters that were never encoded pass through unchanged.
If you want a different flavour of the same thing, try the HTML encoder.
How to use this decoder
Paste the encoded fragment, usually a query-string value copied from a browser address bar or a log file, and read the plain text below. The tool uses decodeURIComponent() inside a guard: if the input contains a stray percent sign or an incomplete group such as %2, it reports malformed percent-encoding instead of crashing. To encode text again, use the URL encoder.
Decoding runs in your browser, so the string you paste — often a query string carrying tokens or email addresses — is never uploaded or stored on a server.
The JSON formatter covers the same ground with a different mechanism.
Reference for common sequences
These groups appear in almost every query string:
| Sequence | Character |
|---|---|
| %20 | space |
| %26 | & |
| %3D | = |
| %3F | ? |
| %2F | / |
| %23 | # |
If the decoded value looks like Base64, continue with the Base64 decoder.
Some values are encoded twice, usually because a URL was passed as a parameter inside another URL. You will see %253D instead of %3D: decode once to get %3D, then decode again for the real character.
Frequently asked questions
- What does hello%20world decode to?
- It decodes to hello world, since %20 is the byte value of a space.
- Why do I get a malformed percent-encoding message?
- The text contains a percent sign that is not followed by two valid hex digits, so it cannot be decoded safely.
- Does it turn plus signs into spaces?
- No. It follows decodeURIComponent, which leaves + as a literal plus. Replace + with %20 first if the value came from an HTML form.
- Can I decode a whole URL at once?
- Yes, but structural characters will be decoded too, so the result is for reading rather than for use as a live link.
- Is the text I decode kept or logged?
- No. Decoding runs in your browser with JavaScript, so the string you paste is never uploaded or stored. That matters because query strings often carry tokens, session IDs and email addresses.