Incomplete percent triplet
A trailing % or value such as %2 lacks a full byte. Keeping it silently can make one component disagree with another strict decoder.
Reveal one encoding boundary
Decode percent-encoded URL text online
Paste up to 200,000 UTF-16 code units, select the matching component, URI, or form context, and decode exactly one layer. The page reports invalid percent escapes and never visits the output.
Loading the URL decoder…
Enable JavaScript to decode and copy text. The strictness and security guidance below remains readable.
Triplets become bytes, then UTF-8 text
How strict URL decoding works
A percent triplet contains % followed by exactly two hexadecimal digits. Decoding %2F produces byte 2F, which is the ASCII slash. Non-ASCII characters require several triplets because their UTF-8 representation contains several bytes. Korean 한, for example, is represented by three UTF-8 bytes and therefore three percent triplets.
Strict decoding has two useful failure boundaries. First, every percent sign must introduce two hexadecimal digits. Second, the recovered byte sequence must be valid UTF-8 for component text. A forgiving decoder can conceal a damaged log line or create different interpretations between a proxy, framework, and application. This tool makes malformed input visible instead.
One click removes only one layer. The encoded text %252F becomes %2F after one round because %25 represents a percent sign. It does not immediately become a slash. That intermediate state is important when diagnosing double-encoding and when evaluating validation that occurs before another layer decodes the value.
Decoding is not decryption, malware scanning, redirect analysis, or URL validation. The output can contain delimiters, credentials, control characters, or misleading Unicode. Treat decoded text as untrusted data and inspect it before copying it into a browser, command, template, database query, or security decision.
- Percent triplet
- A percent sign followed by exactly two hexadecimal digits representing one byte.
- Character decoding
- Recovered bytes are interpreted as UTF-8 in strict component decoding.
- Rounds
- Exactly one layer per operation; no automatic recursive decode.
- Limit
- 200,000 UTF-16 code units per operation.
- Network behavior
- No upload, navigation, resolution, fetch, or redirect following.
Decode with the producer's rules
Component, full URI, and form decoding
ModeImportant behaviorTypical source
URL component
strict percent + UTF-8A path segment, query value, fragment value, or output produced with component encoding.Full URI
preserves reserved escapesA complete URI encoded with full-URI rules, where decoding reserved delimiters could change its structure.Form
+ → space, %2B → +application/x-www-form-urlencoded query or form data serialized by a browser API such as URLSearchParams.See why %20 and + are not interchangeable in every URL context →
Preserve evidence before changing it
How to diagnose encoded data safely
- 1
Keep the original sample
Copy the exact string to a private scratch location before decoding. Do not trim spaces, normalize percent hex case, or replace plus signs until you know the source format.
- 2
Select one known context
Use form mode only for form-style data. For an individual percent-encoded value, start with strict component mode. Use full URI mode when reserved escapes must remain encoded.
- 3
Review one-round output
If percent triplets remain, determine which application layer created them before decoding again. Never make recursive decoding the default for untrusted input.
Failures carry useful information
Why malformed encoded URLs should not be guessed
Non-hexadecimal escape
%GG is not a percent-encoded byte. Report it at the source boundary rather than inventing a replacement value.
Invalid UTF-8 bytes
%FF cannot stand alone as valid UTF-8 text. A replacement character would hide which original bytes were present.
Unexpected second layer
A result such as %2E%2E%2F may be intentional data or another encoded path traversal sequence. Pause before decoding it again.
Readable does not mean safe
Double-decoding and URL security boundaries
Security bugs arise when two layers decode at different times. A front proxy may validate an encoded path while an application server decodes it again, or a router may decode a component before a framework applies another normalization. A value rejected in its final form can sometimes pass an earlier check while still encoded. The defense is a documented canonicalization boundary, not indiscriminate recursive decoding.
Query strings and callback URLs often contain OAuth authorization codes, signed parameters, session identifiers, email addresses, and private filters. Processing here stays in the tab and does not call a decoding service, but copied output can still leak through a clipboard manager, screenshot, ticket, prompt, or extension. Redact secrets before sharing.
The decoder never makes a network request. It cannot tell whether a hostname exists, a redirect is malicious, a link is a phishing page, or a decoded command is safe. Use an appropriate isolated security workflow when the input comes from an untrusted message or incident.
Need structured URL fields?
After decoding only the intended layer, use the URL parser to inspect scheme, host, path, query, and fragment without fetching the destination.
Open the URL parser →Questions answered
URL decoder FAQ
What does a URL decoder do?
A URL decoder interprets valid percent triplets as bytes and decodes the resulting UTF-8 sequence to text under the selected URL context. Form mode also interprets a literal plus sign as a space before percent-decoding.
What does strict URL decoding mean here?
Strict decoding reports an error for a stray percent sign, a percent sign without two hexadecimal digits, or percent-encoded bytes that are not valid UTF-8. It does not silently keep, replace, or guess malformed data.
Does the decoder automatically decode multiple layers?
No. One operation decodes exactly one layer. For example, %2520 becomes %20, not a space. Inspect that intermediate value before deliberately running another decode, because recursive decoding can change structure or bypass validation assumptions.
When does + decode to a space?
A literal plus sign becomes a space only in application/x-www-form-urlencoded form mode. In ordinary URL component and full URI decoding, plus remains plus. A form-encoded literal plus should arrive as %2B.
Why does a URL decoder reject some %XX sequences?
Each %XX triplet represents one byte, not necessarily one complete character. The selected bytes must form valid UTF-8 when decoded as component text. Values such as %FF or an incomplete multibyte sequence have no valid UTF-8 text result and are rejected.
Does this URL decoder upload or open the decoded value?
No. Decoding runs in the current browser tab. The tool does not upload the input, perform DNS lookup, navigate to the output, follow redirects, fetch remote content, or decide whether the decoded address is safe.
What is the URL decoder input limit?
The decoder accepts at most 200,000 UTF-16 code units in one operation. The limit bounds browser conversion and rendering work; it is not a claim about URL length limits in a browser, server, proxy, or application.