URL Decoder

URL decoding, also called percent-decoding, is the process of converting a percent-encoded string back into its original, human-readable characters. When data is transmitted over the internet via URLs, special characters such as spaces, ampersands, question marks, and non-ASCII letters must be encoded to comply with the URI specification defined in RFC 3986. This encoding replaces each unsafe or reserved character with a percent sign followed by a two-digit hexadecimal number representing the character's byte value in UTF-8.

For example, a space character is encoded as %20, an at-sign becomes %40, and a hash becomes %23. The URL decoder reverses this transformation: it scans the encoded string for every percent-sequence and substitutes the corresponding character. This is essential when you receive a URL from a form submission, an API response, a browser address bar, or a server log and need to read the actual content inside it.

There are two standard JavaScript functions used for URL decoding: decodeURIComponent and decodeURI. The key difference is in what they leave untouched. decodeURIComponent decodes every percent-encoded sequence, including characters that are reserved in a URI such as /, ?, #, &, and =. This makes it the right choice for decoding individual query parameter values or path segments. decodeURI decodes everything except the characters that have special structural meaning in a full URI, preserving the integrity of the URL's scheme, host, path separators, and query delimiters. Choose decodeURI when you want to display a complete URL in a readable form without breaking its structure.

Understanding when to apply each decoding mode prevents common bugs such as splitting a query string on an ampersand that should have remained encoded, or losing path separators inside a file name. This online URL decoder calculator lets you switch between both modes instantly so you can verify decoded output before using it in your application.

Percent-encoding was standardized in RFC 3986 (Uniform Resource Identifiers) and earlier in RFC 2396. The mechanism is straightforward: every character that is not an unreserved character — meaning it is not a letter (A–Z, a–z), digit (0–9), hyphen, underscore, period, or tilde — may be percent-encoded. To encode a character, the browser or application takes its UTF-8 byte representation, converts each byte to uppercase hexadecimal, and prepends a percent sign.

For multi-byte characters (most non-Latin scripts, emoji, and many symbols), each byte in the UTF-8 sequence receives its own percent-encoded triplet. The Japanese character 日 (U+65E5) encodes to %E6%97%A5 in UTF-8 — three bytes, three percent-triplets. Decoding reverses exactly this: the percent-encoded triplets are assembled back into bytes, then interpreted as UTF-8 to reconstruct the original Unicode character.

Reserved characters have special roles in URI syntax. The characters : / ? # [ ] @ ! $ & ' ( ) * + , ; = are reserved and should only be percent-encoded when they appear as data inside a component, not when they serve their structural role. decodeURIComponent decodes all of these; decodeURI leaves the ones that carry structural meaning intact.

A common misconception is that + means a space everywhere in a URL. In application/x-www-form-urlencoded (HTML form data), a plus sign does represent a space, but in general percent-encoding it does not — a space is encoded as %20. Neither JavaScript decoding function converts + to a space automatically. If you are decoding HTML form data that uses + for spaces, you must replace + with %20 before decoding, or handle the substitution separately.

Choosing the correct decoding function is one of the most important decisions when working with URLs in JavaScript. Using the wrong one can silently corrupt data or throw a runtime error.

Use decodeURIComponent when you are decoding a component of a URL — that is, a single query parameter value, a path segment, a fragment, or any piece of data that appears inside the URL rather than forming the URL's own structure. For example, if a URL contains ?search=hello%20world%26more and you extract the value hello%20world%26more, you should call decodeURIComponent on it to get hello world&more. If you used decodeURI instead, the %26 would remain encoded.

Use decodeURI when you want to display a complete URL to a user in a human-friendly form without altering its navigability. A URL like https://example.com/path%20with%20spaces?q=test%3Dvalue decoded with decodeURI becomes https://example.com/path with spaces?q=test%3Dvalue — the space in the path is decoded, but %3D (an equals sign inside a query value) is left encoded because = is a reserved delimiter character.

If the encoded input contains an invalid percent sequence — such as a lone % not followed by two hex digits, or a malformed multi-byte UTF-8 sequence — both functions throw a URIError. This tool catches that error and displays the message so you know which part of your input is malformed.

When debugging encoded URLs or writing code that constructs and parses URLs manually, it helps to know the most frequently encountered percent-encoded sequences at a glance. The table below lists the characters you will see most often in query strings, form submissions, and API endpoints.

Knowing these mappings lets you quickly spot what a percent-sequence represents without running it through a decoder first, which is especially useful when reading server access logs or debugging network requests in browser DevTools.

URL decoding is not just a developer curiosity — it is a daily task for anyone who works with web data. Here are the most common real-world scenarios where an online URL decoder calculator saves time and prevents errors.

Debugging API requests: REST APIs often receive and return URLs or redirect targets inside JSON payloads. When an API error message contains a percent-encoded URL, pasting it into a URL decoder immediately reveals the actual target, helping you trace where a redirect chain went wrong.

Reading email marketing links: Email campaign links are heavily encoded with tracking parameters. The raw link in an email source can look like https://click.example.com%2Fcampaign%3Fid%3D12345%26source%3Dnewsletter. Decoding it shows you the real destination and all tracking parameters in plain text.

Parsing server logs: Web server access logs (Apache, Nginx) record the raw request URI, which includes percent-encoded paths and query strings. Decoding these entries makes it practical to read log files and understand what pages and parameters were actually requested.

Working with OAuth and SSO: OAuth 2.0 and SAML flows pass encoded tokens, redirect URIs, and state parameters in query strings. Decoding these values is essential for debugging authentication failures or inspecting the claims inside a redirect.

Handling internationalized content: URLs containing non-ASCII characters — such as search queries in Chinese, Arabic, or accented European languages — are transmitted as percent-encoded UTF-8. A URL decoder renders them back into legible text so you can verify that the correct content is being requested.

Form data analysis: HTML forms submitted with method="GET" append field values as percent-encoded query parameters. Decoding the query string lets you read the exact user input that was submitted, which is invaluable for QA testing and analytics validation.

URL encoding and decoding intersect with web security in important ways. Understanding these relationships helps developers avoid vulnerabilities and recognize attack patterns.

Double encoding: An attacker may encode a character twice — for example, encoding the percent sign itself so that %2F (a slash) becomes %252F. If a server decodes the URL once, it sees %2F (still encoded) and may pass it through security checks. A second decode then produces the slash. Web application firewalls and input validators must normalize URLs fully before comparing against blocklists. When you decode a string and it still contains percent-sequences, decode it again to check for double encoding.

Path traversal: The sequence ../ can be percent-encoded as %2E%2E%2F or ..%2F to attempt directory traversal attacks. Servers that naively concatenate decoded path segments without normalizing .. references may expose files outside the intended web root. Always normalize the resolved path after decoding.

Open redirect vulnerabilities: When a URL is passed as a query parameter (e.g., ?next=https%3A%2F%2Fattacker.com), the server or client must decode and validate it before redirecting. Failing to decode before validation means a blacklist check on the literal percent-encoded string can be bypassed.

Safe usage of this tool: This URL decoder runs entirely in your browser — no data is sent to a server. You can safely paste sensitive tokens, session parameters, and internal API URLs without transmitting them to a third party.