URL Decode

How to URL decode

1. Paste the encoded text, or a full URL, into the left box. The decoded text appears on the right as you type.
2. Keep + as space on for query strings and form data; turn it off if the text contains real plus signs.
3. If you paste a whole URL with a query string, the URL breakdown lists the origin, path, fragment and every parameter, decoded.
4. If a % isn't followed by two hex digits, or the bytes aren't valid UTF-8, the message shows where. Press Select it to jump to the problem.

To go the other way, use the URL encoder, or press Swap ⇄.

What %20, %3D and other codes mean

URL encoding, also called percent-encoding, writes a character as % plus its byte value in hexadecimal. Characters outside ASCII are first converted to UTF-8, so they take two to four %XX codes. The ones you will see most often:

URL decode examples

Decoding a full URL and its query parameters

A query string is a list of name=value pairs joined by &. Each name and value is encoded separately, so a value can itself contain an encoded URL. Paste this link into the decoder:

https://example.com/search?q=caf%C3%A9+au+lait&tags=coffee%2Cmilk&redirect=https%3A%2F%2Fexample.org%2Fcart%3Fid%3D42#top

and the breakdown shows the path /search, the fragment #top and these parameters:

Decoding the whole URL at once would turn the %26 and %3D inside the redirect value into real & and =, and you could no longer tell where one parameter ends. The breakdown splits the query first and then decodes each part, which is how servers read it.

decodeURI vs decodeURIComponent

JavaScript has two decoders. decodeURIComponent() decodes everything and is right for a single value. decodeURI() leaves the escapes of reserved characters (; / ? : @ & = + $ , #) alone, so the structure of a full URL doesn't change. Tick Keep %2F, %3F… (decodeURI) to get the second behaviour. For https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Da%2520b:

• decodeURIComponent: https://example.com/search?q=a%20b
• decodeURI: https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Da%20b

Neither turns + into a space; that is a form-encoding rule, which is why the tool has a separate option for it.

Malformed % sequences and invalid UTF-8

Two problems make most decoders fail with “URI malformed”. This one reports them with their position and still decodes the rest:

• 100% sure: Malformed escape "% s" at position 4: "%" must be followed by two hex digits (0–9, A–F). A literal % is written %25.
• caf%E9: Invalid UTF-8 at position 4: "%E9" is not a complete UTF-8 character. The text may have been encoded in another character set (such as Latin-1) or cut off. It decodes to caf�, where � marks the bad byte.

A %25 followed by two hex digits (like %2520) is different: it's valid, but the text was encoded twice. The decoder notices and offers a Decode again button.

URL decode in JavaScript, Python, PHP and C#

// JavaScript: + is not a space for decodeURIComponent, so replace it first for form data
decodeURIComponent("caf%C3%A9+au+lait".replace(/\+/g, " "));   // "café au lait"
new URLSearchParams("q=caf%C3%A9+au+lait").get("q");            // "café au lait"

# Python
from urllib.parse import unquote, unquote_plus, parse_qs
unquote_plus("caf%C3%A9+au+lait")                                # 'café au lait'

// PHP: urldecode() reads + as a space, rawurldecode() doesn't
urldecode("caf%C3%A9+au+lait");

// C#
System.Net.WebUtility.UrlDecode("caf%C3%A9+au+lait");           // + as space
Uri.UnescapeDataString("caf%C3%A9%20au%20lait");

Related developer tools

• URL encoder: percent-encode text, query values or whole URLs.
• Base64 decoder: for Base64 values you find inside URLs.
• JWT decoder: for tokens passed in links and Authorization headers.
• JSON formatter: for JSON you decoded from a query parameter.

Frequently asked questions