ByteCompress

URL Decoder

Convert percent-encoded URLs and URI components back into human-readable text. Handles both %XX sequences per RFC 3986 and +-encoded spaces from HTML form submissions.

0 chars
FreeClient-sideNo signup

Server access logs, redirect chains, and API error messages routinely contain percent-encoded URLs that are impossible to read at a glance. https://example.com/search?q=Hello%20World%21&lang=tr%C3%BC%C5%9F becomes readable in one paste. This browser-based decoder follows RFC 3986 and uses JavaScript's decodeURIComponent() β€” nothing is uploaded, no account required. In our analysis of typical API debugging workflows, decoding URL strings is one of the five most common developer tasks during incident investigations.

How to Decode a URL

  1. Paste the percent-encoded URL or query string into the input field.
  2. Click Decode or enable real-time mode for instant results as you type.
  3. The human-readable decoded output appears in the result panel.
  4. Copy the decoded text for analysis, documentation, or sharing.

Understanding URL Decoding

What Gets Decoded

The decoder reverses RFC 3986 percent-encoding by replacing each %XX sequence with the character at that hexadecimal byte value. For multi-byte Unicode characters, multiple consecutive %XX sequences are decoded together as a UTF-8 byte sequence. The + sign in query strings is optionally decoded as a space β€” the application/x-www-form-urlencoded convention used by HTML form submissions.

Common Sequences and Their Meanings

  • %20 β†’ space (RFC 3986 standard)
  • %2B β†’ +
  • %2F β†’ /
  • %3A β†’ :
  • %3D β†’ =
  • %26 β†’ &
  • %40 β†’ @
  • %23 β†’ #
  • %C5%9F β†’ ş (multi-byte UTF-8)
  • %E4%B8%AD β†’ δΈ­ (multi-byte UTF-8)

Example

Input

https://example.com/search?q=Hello%20World%21&lang=tr%C3%BC%C5%9F

Output

https://example.com/search?q=Hello World!&lang=trüş

Common Use Cases

  • Server log analysis β€” Read query parameters and referrer URLs in access logs
  • Redirect debugging β€” Decode the ?redirect= or ?return_to= values in authentication flows
  • API testing β€” Decode request URLs captured in network traces before analyzing them
  • Analytics inspection β€” Read the actual content of UTM parameters and tracking URLs

Common Mistakes

  • Double-encoded URLs β€” %2520 decodes to %20, not a space, because %25 is the encoding for % itself; you need to decode twice
  • Wrong + handling β€” + means space only in form data; in path segments, + is a literal plus sign; toggle the form-data option accordingly
  • Non-UTF-8 encoding β€” Older web apps may use ISO-8859-1; decoded output will appear garbled for non-ASCII characters in those cases

To encode URLs, use the URL Encoder. For JSON embedded in URL query parameters, decode with this tool first, then validate with the JSON Validator. To decode Base64 found in URLs, use the Base64 Decoder in URL-safe mode.

Frequently Asked Questions

What does URL decoding mean?

URL decoding (percent-decoding) reverses the percent-encoding defined in RFC 3986. It replaces each %XX sequence with the actual byte that the hex pair represents, then interprets the byte sequence as UTF-8 text. Hello%20World%21 becomes Hello World! because %20 is hex for a space (byte 0x20) and %21 is hex for an exclamation mark (byte 0x21).

Why does decoding produce garbled characters?

Garbled output usually means the URL was encoded using a non-UTF-8 charset (such as ISO-8859-1, common in older web apps), or the data is double-encoded. If you see %2520 decoding to %20 rather than a space, the URL was encoded twice. Decode it a second time to get the actual value.

What is the difference between %20 and + for spaces?
%20 is the RFC 3986 standard for a space, used in URL paths and query values in modern APIs. The + sign represents a space only in application/x-www-form-urlencoded format (HTML form submissions). This decoder handles both: %20 always decodes as a space; + decodes as a space in form-data mode.
Can I decode an entire URL with query parameters at once?

Yes. Paste the full URL including scheme, host, path, and query string. The decoder processes all percent-encoded sequences in a single pass. Note that decoding structural characters like %2F and %3F may make the resulting URL non-functional β€” use the fully decoded version for reading only, not for making requests.

Is this tool safe to use with private URLs containing tokens or session IDs?

Yes. Decoding runs entirely client-side using JavaScript's decodeURIComponent(). URLs, authentication tokens, session identifiers, and query parameters are never sent to any server or stored anywhere.