URL Decoder

How to decode a URL

1. Paste the link, query string or encoded text into Your text, or click Example to load a sample search link. You can also use Open file for a plain-text file, such as a server log.
2. The decoded text appears in Result as you type. Nothing to click.
3. Change the options if you need to: untick Treat + as a space (query strings) for paths and file names, or tick Decode repeatedly for links that were encoded twice. A list of links can be decoded in one go; line breaks are kept as typed.
4. Read the note under the result. If it says some percent sequences were left as written, see the rules below.
5. Click Copy or Download .txt, or Use as input to work further on the result. To list every link in a long text first, use Extract URLs.

The example shows all three common cases at once:

%C3%A9 is the two UTF-8 bytes of é, + is a space, %26 is an ampersand and %2F is a slash.

What percent codes mean

A URL can only carry a limited set of characters. Everything else, and any character that would otherwise have a special job in the link, is written as bytes: a % followed by two hexadecimal digits per byte. Text is first turned into UTF-8, so a letter outside basic ASCII takes two to four codes. RFC 3986 lists the characters with a special job, such as :, /, ?, #, &, = and +. Upper and lower case hex digits mean the same thing, so %c3%a9 and %C3%A9 both decode to é.

The guide to URL encoding explains which characters get encoded and why.

The options

+ as a space. Form encoding, the format browsers use for search boxes and form submissions, writes a space as +, and the URL Standard’s parser turns every + back into a space. Outside form data a plus is just a plus, so https://example.com/path+with+plus/file%20name.pdf decodes to path+with+plus/file name.pdf with the option off and to path with plus/file name.pdf with it on. Choose by the part you are decoding: query string on, path off.

Decode repeatedly. %25 is an encoded percent sign, so a link that went through two encoders contains %2520 where it once had %20. With this option on, the tool decodes again while any %XX code remains, up to six passes in total. Use it only when you know the text was encoded more than once: RFC 3986 warns against decoding the same string twice because real data can contain a percent sign. 50%2541 is either a doubly encoded 50A or the text 50%41, and only the source knows which.

Treat + as a space applies only to the text as you pasted it, on the first pass. A + that appears later, decoded from %2B, stays a plus sign, so with both options on C%2B%2B+guide%2520pdf gives C++ guide pdf.

Lists of links. Paste one link per line and they are all decoded at once. Line breaks, including Windows line endings, are kept exactly as typed.

Broken and unusual input

The tool never fails on bad input; it decodes what it can and leaves the rest exactly as written:

When %XX codes are left over, with or without Decode repeatedly, the note under the result counts them and lists where they are (the first five positions), for example “2 percent sequences left as written (not valid UTF-8, or still encoded): line 1, column 1; line 1, column 5” for %E9t%E9. Codes from old pages in Latin-1 or Windows-1252 cannot be read as UTF-8, so they stay encoded rather than turning into wrong characters.

Encoded line breaks (%0A, %0D%0A) become real line breaks in the result. Everything else in the text, including spaces, accents already typed as characters and HTML entities such as &, is left alone; decode entities with the HTML entity converter.

When people need it

• Reading a wrapped link. Microsoft Safe Links rewrites links in email so they start with a safelinks.protection.outlook.com address, and many redirect and tracking services carry the real address as an encoded parameter. Decoding shows where the link actually goes before you click it.
• Checking UTM and tracking parameters in analytics exports, where campaign names arrive as spring%20sale%7Cemail.
• Debugging redirects and sign-in flows. A redirect_uri or return parameter often contains a whole second URL, https%3A%2F%2F....
• Cleaning server logs and spreadsheets where search terms and file names were saved encoded, such as name=Jos%C3%A9+Garc%C3%ADa, which decodes to name=José García.
• Reading API errors, where a query value such as email=jane.doe%40example.com needs to be checked by eye.

A decoded link is for reading, not always for pasting back. Decoding a nested link brings its & and ? up to the same level as the outer link’s:

Before: https://redirect.example.net/?url=https%3A%2F%2Fexample.com%2Fpricing%3Fplan%3Dpro%26ref%3Demail&id=7%7C42
After:  https://redirect.example.net/?url=https://example.com/pricing?plan=pro&ref=email&id=7|42

In the result you can no longer tell whether ref=email belongs to the inner link or the outer one. To build a link that works, re-encode the inner value with the URL encoder.

URL decoding vs Base64 and other formats

Percent-encoding is easy to spot: % followed by two hex digits. If a parameter is a long run of letters and digits ending in = or ==, with no percent signs, it is probably Base64; paste it into the Base64 decoder instead. Some values are both: a Base64 string placed in a URL often has its = encoded as %3D, so decode the URL first, then the Base64.

This tool decodes everything, including %2F, %3F and %26, the way JavaScript’s decodeURIComponent does. That is what you want for reading a link. It differs from decodeURI, which keeps codes for characters that have a special job in a URL so the link’s structure does not change.

Questions