About URL Decode
Decoding reverses percent-encoding: every %XX triplet is turned back into the byte it represents, and the resulting byte sequence is read as UTF-8 text. This is what turns a copied browser address bar back into something readable — a search query, an email address, a redirect target buried inside a tracking parameter.
It is worth running whenever a URL looks unreasonable rather than merely long. A redirect chain or an affiliate link may carry the real destination as a percent-encoded parameter, and the visible URL tells you nothing about where it actually goes. Decoding it once makes the intent plain.
Decoding is also the fastest way to diagnose the double-encoding bug. If the output still contains %XX sequences after one pass, the value was encoded twice somewhere upstream, and that is usually the root cause of a parameter that refused to work.
The page reverses one encoding layer per pass and stops there. It will not keep unwrapping nested encoding automatically until the percentages are gone, and it offers no depth setting telling it how many layers to strip. There is equally no support for the form-encoding convention in which a plus sign stands for a space — a + in the input is left as a plus rather than being read as whitespace, so a value that came from an HTML form body may decode with stray plus signs in it. Malformed triplets are passed through as they were written instead of being reported, and no length or character count is shown for the result.
How to use URL Decode
- 1 Paste the percent-encoded string — with or without the surrounding URL.
- 2 The decoded text is shown immediately.
- 3 If the output still contains %XX sequences, decode it a second time to unwrap double-encoding.
Frequently asked questions
The decoded result still contains % signs. Why?
The value was encoded more than once. This happens when a system encodes a parameter that had already been encoded, usually because two layers of code each assumed it was responsible. Decoding repeatedly until the percentages are gone reveals the original value.
Why do spaces sometimes decode to plus signs?
Some producers encode spaces as + rather than %20, following the form-encoding convention. They mean the same thing in that context, so treat a literal + in a query string as a space unless you know the value was percent-encoded throughout.
Can I use this to see where a shortened or redirecting link goes?
It helps when the destination is carried as an encoded parameter, which is common for analytics and affiliate links. For a plain redirect there is no encoded destination in the address itself — you need to follow the response headers to see the target.
Is decoding safe?
Decoding is harmless on its own — it only turns text back into other text. Be cautious about what you do with the result: a decoded URL can point somewhere you would rather not visit, so read it before opening it.
Free, online, and private
Free to use
URL Decode is completely free. There is no account to create, no login, and no hidden charge or usage limit.
Runs online in your browser
It is a free online tool that runs entirely in your browser. Nothing to download or install — open the page and start using it right away.
Your data stays private
All processing happens locally on your device. Your input is never uploaded, stored, or tracked, so it never leaves your browser.
How URL Decode behaves in detail
These are the specifics of this implementation — the exact ranges, defaults and fixed settings you are working with.
| Parameter | Value |
|---|---|
| Decoder | decodeURIComponent — the component-level unescape |
| Plus sign | left alone as a literal +, never translated into a space |
| Multibyte input | handled — three percent escapes produce one CJK character |
| Failure mode | a malformed escape makes the whole input come back unchanged |
| Recovery attempt | none — the string is not retried character by character |
Compiled from the implementation of this tool and checked against it by itoolnet.
What URL Decode does not do
Knowing the edges of a tool saves more time than another list of its features. These are the cases where it will not do what you might expect.
- A plus sign is an ordinary character here. Values submitted by an HTML form encode spaces as +, so a query string from that source decodes with the plus signs still embedded, and the substitution has to be made by hand afterwards.
- Decoding is all or nothing. One stray percent sign anywhere — a bare % at the end, or prose like 100% sure — throws inside the decoder and the input is then returned verbatim, so a total failure looks exactly like success on text that was already plain.
- It expects UTF-8 escapes. A single-byte sequence such as %E9, which is Latin-1 for é, is an invalid UTF-8 lead byte, so the whole string stays undecoded instead of falling back to another character set.
Tested and documented by itoolnet, the team that builds and maintains this site.