Introduction to the URL Decoder and Encoder
Every developer, analyst, or SEO professional who works with web URLs has encountered percent-encoded strings — those sequences of %20, %3D, and %2F characters that make URLs look like gibberish. A URL like https://example.com/search?q=caf%C3%A9%20shop&city=New%20York is perfectly valid and functional, but its meaning is obscured by the encoding. Decoding it instantly reveals https://example.com/search?q=café shop&city=New York — the human-readable form that makes the query immediately understandable.
This free URL decoder and encoder handles both directions with precision. Decode any percent-encoded URL or string back to readable text — including multi-byte UTF-8 encoded characters like Chinese, Japanese, Arabic, and accented Latin characters. Encode plain text or URLs into percent-encoded format safe for web transmission. A built-in URL Component Parser breaks any full URL into its individual parts — scheme, host, path, query string, and fragment — and displays every query parameter as a decoded key-value table. Recursive decode handles double-encoded URLs. Four real-world sample inputs load immediately for exploration.
All processing runs in your browser using JavaScript's native decodeURIComponent() and encodeURIComponent() functions. No data is sent to any server. Real-time output updates as you type — no button press needed.
What This URL Decoder and Encoder Can Do
Bidirectional Decode and Encode
Switch between Decode URL (percent-encoded → readable) and Encode URL (plain text → percent-encoded) with a single click. Both directions update in real time as you type. No button press required — output is always live and current.
URL Component Parser with Query Parameter Table
Switch to the URL Parser tab to see any full URL broken into scheme, host, port, path, query, and fragment. All query parameters are decoded and displayed as a formatted key-value table — each parameter on its own row with its decoded key and decoded value.
Recursive Decode for Double-Encoded URLs
Enable Recursive Decode to automatically handle URLs encoded multiple times — such as %2520 (double-encoded space). The tool decodes up to 10 rounds, stopping when no further changes occur, and reports how many rounds were applied.
encodeURIComponent vs encodeURI Mode
In encode mode, choose between encodeURIComponent (encodes everything including / ? & = — correct for parameter values) and encodeURI (preserves URL structural characters — correct for encoding a full URL). The difference is critical for correct URL construction.
%20 vs + Space Encoding
Choose whether spaces encode as %20 (standard URI encoding, correct for paths and most query strings) or + (form-data encoding, used by HTML form submissions in application/x-www-form-urlencoded format). Toggle instantly without re-entering text.
Full Unicode / UTF-8 Support
Correctly decodes multi-byte UTF-8 percent-encoded sequences for any Unicode character — Chinese (%E4%B8%AD), Japanese (%E6%97%A5), Arabic, accented Latin (é = %C3%A9), emoji, and all other non-ASCII characters in URLs.
Four Real-World Sample Inputs
Load a simple encoded URL, a query string, a Japanese Wikipedia URL with UTF-8 encoding, or a double-encoded URL — each demonstrating a different practical use case. Click any sample button to load it immediately.
100% Browser-Based — Private & Real-Time
All decoding and encoding uses JavaScript's built-in functions locally in your browser. No data leaves your device. Works offline once the page has loaded. Safe for URLs containing sensitive parameters, API keys, and authentication tokens.
Who Is This URL Decoder Useful For?
- Web developers and back-end engineers: Decode API request logs, debug URL-encoded form submissions, verify correct encoding of query parameters in API calls, and understand what data is being transmitted in encoded URL parameters.
- Front-end developers: Debug URL construction in JavaScript, verify the correct use of
encodeURIComponent()vsencodeURI(), decode URLs in browser history and navigation logs, and inspect the query parameters being passed to SPAs. - SEO professionals and digital marketers: Decode tracking URLs with UTM parameters, inspect encoded redirect destinations in campaign links, decode Google Analytics parameters, and verify that canonical URLs are correctly formed without encoding artifacts.
- QA engineers and testers: Decode URL parameters in test logs and automated test output, verify that application URL construction is encoding parameters correctly, and debug cases where special characters in form inputs are mishandled.
- Security researchers and penetration testers: Decode percent-encoded payloads in URL injection attempts, identify double-encoded sequences that might bypass input validation, and analyse URL-based attack vectors in security testing.
- Data analysts and data engineers: Decode URL parameters in web analytics exports, server access logs, and click-tracking data to extract the original query values for analysis.
- Content writers and editors: Decode readable text from encoded URLs in internal links, affiliate links, and shared URLs before including them in editorial content or documentation.
- System administrators: Decode URLs in web server access logs, Nginx/Apache rewrite rules, and proxy configurations to understand what requests are actually being processed.
What Is URL Encoding and URL Decoding?
URL encoding — formally called percent encoding — is the mechanism defined in RFC 3986 for representing characters in a URI that would otherwise be ambiguous or invalid. The URL character set is restricted to a specific set of ASCII characters: the unreserved characters (letters, digits, hyphen, dot, underscore, tilde) that can appear in a URL without any special treatment, and the reserved characters (colon, slash, question mark, hash, ampersand, equals, etc.) that have structural meaning in URLs.
Any character outside this restricted set — including spaces, most punctuation, and all non-ASCII Unicode characters — must be percent-encoded before appearing in a URL. Percent encoding converts each byte of the character's UTF-8 representation to a three-character sequence: a literal percent sign (%) followed by two uppercase hexadecimal digits representing the byte value. The space character (ASCII 32, hex 0x20) becomes %20. The forward slash (ASCII 47, hex 0x2F) becomes %2F. The at sign (ASCII 64, hex 0x40) becomes %40.
For non-ASCII Unicode characters, the encoding is based on UTF-8 bytes rather than Unicode code points directly. The character é (U+00E9) encodes as the two UTF-8 bytes 0xC3 and 0xA9, producing %C3%A9. The Chinese character 中 (U+4E2D) encodes as three UTF-8 bytes (0xE4, 0xB8, 0xAD), producing %E4%B8%AD. This means URLs from different locales contain multi-byte percent-encoded sequences that look cryptic but are entirely systematic — and this tool decodes all of them correctly.
URL decoding reverses this process: it replaces each %HH sequence with the corresponding byte value, then interprets the resulting byte sequence as UTF-8 to reconstruct the original Unicode characters. JavaScript's decodeURIComponent() performs this operation and is the function this tool uses internally.
The distinction between decoding and parsing is important. Decoding converts percent sequences to characters. Parsing understands URL structure — it separates the decoded URL into its functional components (scheme, authority, path, query, fragment) and further parses query strings into their individual key-value parameter pairs. This tool does both.
Benefits of Using a URL Decoder Tool
Instantly Readable URLs in Logs and Analytics
Web server access logs, Google Analytics exports, API gateway logs, and click-tracking systems all store URLs in their percent-encoded form. A log entry showing /search?q=caf%C3%A9%20latte&location=New%20York&sort=price_asc requires mental decoding to interpret. Pasting it into a URL decoder instantly reveals /search?q=café latte&location=New York&sort=price_asc — and the Query Parameter table further separates this into three labelled rows: q = café latte, location = New York, sort = price_asc.
For analysts working through thousands of log entries or campaign URLs, the ability to instantly decode and parse query parameters dramatically reduces the time needed to understand what queries are being executed, what campaign parameters are being tracked, and what data is being passed between application components.
For web developers debugging API calls, understanding the exact encoded form of parameters being sent to an API is critical. When a user's name "O'Brien & Co." appears as O%27Brien%20%26%20Co. in a network request, it is correct — but if it appears as O'Brien & Co. (unencoded), it is a bug that will break query string parsing in the receiving API. A URL encoder makes the correct form immediately visible for comparison.
For security testing, the ability to decode percent-encoded payloads — including double-encoded sequences — is essential for identifying URL-based injection attacks. A payload like %253Cscript%253E decodes in two rounds to <script>, demonstrating a double-encoded XSS attempt. The recursive decode option in this tool makes such sequences immediately identifiable.
For SEO and digital marketing, UTM campaign URLs and affiliate tracking links are typically URL-encoded when copied from platforms like Google Analytics, HubSpot, or affiliate networks. Decoding them reveals the actual campaign values, allowing verification that the correct parameters are being tracked and that special characters in campaign names (like & or +) are correctly encoded rather than creating parameter parsing ambiguity.
Why URL Encoding Matters in Web Development
URL encoding is not merely a technical formality — it is a fundamental security and correctness requirement for any web application that handles user input in URLs, query strings, or form data. The consequences of incorrect URL encoding range from broken functionality to critical security vulnerabilities.
The most common encoding-related bugs fall into predictable categories. Spaces in search queries that are not encoded cause the URL to break at the space — the browser or server interprets the space as a delimiter between separate URL components, truncating the query. Ampersands in parameter values that are not encoded as %26 are misinterpreted as parameter separators, splitting a single value into multiple incorrect parameters. Equals signs in parameter values that are not encoded as %3D are misinterpreted as key-value delimiters.
The distinction between encodeURIComponent() and encodeURI() in JavaScript — mirrored in the encoding mode options of this tool — reflects a deep technical requirement. encodeURI() preserves structural characters (/, ?, &, =, #, :) because it is designed to encode a complete URL while preserving its structure. encodeURIComponent() encodes everything including those structural characters — because individual parameter values should not contain unencoded characters that could be interpreted as URL structural elements. Confusing these two functions is one of the most common sources of encoding bugs in JavaScript applications.
For internationalisation, URL encoding enables URLs in any language. Without it, characters outside the ASCII set could not appear in URLs at all. With it, a URL pointing to a Japanese Wikipedia article, an Arabic news site, or a French e-commerce product page with accented characters is perfectly valid and can be transmitted over any HTTP infrastructure that expects ASCII text — because the non-ASCII characters have been percent-encoded to ASCII-safe sequences.
How to Use the URL Decoder and Encoder
Choose Decode or Encode Mode
Click 'Decode URL' to convert percent-encoded strings to readable text, or 'Encode URL' to convert plain text to percent-encoded format. Both modes update output in real time as you type — no button press needed.
Paste Your URL or Text
Paste any percent-encoded URL, query string, or encoded parameter value into the input panel. For encoding, paste plain text, a raw URL, or form data. Click any of the four sample buttons to load a real-world example immediately.
Enable Recursive Decode if Needed
If your URL appears to be encoded multiple times (you still see %25 sequences after decoding), enable Recursive Decode in the options panel. The tool will decode up to 10 rounds, stopping when no further changes occur. The stats bar reports how many rounds were applied.
Set Encoding Mode and Space Handling (for Encode)
In Encode mode, choose encodeURIComponent (encode all special chars, correct for parameter values) or encodeURI (preserve URL structural chars, correct for full URLs). Choose %20 or + for space encoding depending on whether you need URI or HTML form data format.
Switch to URL Parser Tab
Click the URL Parser tab in the output panel to see the full URL broken into its component parts — scheme, host, path, query, fragment. If the URL has query parameters, they appear as individual decoded key-value rows in the parameters table.
Copy or Download
Click Copy Result to copy the decoded or encoded text to your clipboard. Use individual component copy buttons in the URL Parser to copy specific parts. Click Download to save the output as a .txt file.
Common Use Cases for URL Decoding and Encoding
- Decoding UTM campaign URLs: Marketing URLs with UTM parameters (utm_source, utm_medium, utm_campaign) often contain encoded campaign names with spaces and special characters. Decode them to verify the exact campaign values and check that all parameters are correctly formed.
- Debugging API query strings: When an API request fails because a query parameter contains an unencoded special character, use the encoder to see the correct encoded form, or use the decoder to understand what a malformed encoded parameter actually contains.
- Reading server access logs: Apache, Nginx, and other web server logs store request URLs in their encoded form. Decode individual log entries to understand what queries users are submitting, what pages they are requesting, and what parameters are being passed.
- Decoding redirect URLs: Tracking pixels and link shorteners often encode the destination URL as a query parameter value. Decode the full redirect URL to see the actual destination — critical for security review of links before clicking them.
- Parsing OAuth and SSO callback URLs: Authentication callbacks (OAuth 2.0, SAML, OpenID Connect) contain encoded parameters including state tokens, authorisation codes, and error messages. Decode and parse these URLs to debug authentication flows.
- Extracting Google Search Console URLs: Google Search Console reports and API exports contain encoded search queries in URL format. Decode them to see the actual search terms that triggered impressions and clicks.
- Encoding user-generated content for URLs: When building a URL that includes user-submitted data — a search term, a product name, a user bio — encode the value with encodeURIComponent() to ensure all special characters are safely represented without breaking URL parsing.
- Debugging double-encoded URLs: Proxy servers, CDNs, and URL rewriting layers sometimes encode URLs that are already encoded, creating double-encoded sequences. Use Recursive Decode to unwrap all encoding layers and see the original URL.
Best Practices for URL Encoding
- Always use encodeURIComponent() for parameter values: When constructing URLs in JavaScript by concatenating query parameter values, always encode each value with
encodeURIComponent()— notencodeURI()and not manual string replacement. OnlyencodeURIComponent()correctly handles ampersands, equals signs, and other characters that have special meaning in query strings. - Do not double-encode: If a value is already percent-encoded, encoding it again creates double-encoding that most URL parsers will not correctly handle. Decode first to verify whether a value is already encoded before encoding it. The recursive decode option in this tool helps identify already-encoded values.
- Decode for display, encode for transmission: The correct rule is: decode URLs for human-readable display in your UI, but always transmit encoded URLs over HTTP. Never display percent-encoded text to users when the decoded form is available and safe to show.
- Use the URL constructor in JavaScript instead of manual encoding: The browser's built-in
URLAPI andURLSearchParamshandle encoding automatically and correctly.new URL(base)andurl.searchParams.set(key, value)encode values correctly without the risk of manual encoding errors. - Understand the difference between + and %20: Both represent spaces, but in different contexts.
%20is the correct URI encoding for spaces in path segments and general query strings.+represents spaces only inapplication/x-www-form-urlencodedformat (HTML form submissions). Using+in a path segment does not represent a space — it is a literal plus sign. - Validate decoded input server-side: Never treat a decoded URL parameter as safe input without validation. URL decoding is not a security mechanism — it simply restores the original characters, which may include injection payloads, SQL injection attempts, or XSS strings that were percent-encoded in the original request. Always validate and sanitise decoded input before processing.
Top URL Decoder Tools in the Market
- This URL Decoder / Encoder (current tool): Bidirectional real-time decode and encode (no button press), URL Component Parser with query parameter table, recursive decode for double-encoded URLs, encodeURIComponent vs encodeURI mode, %20 vs + space encoding toggle, full UTF-8 Unicode support, four real-world samples. The most feature-complete free URL decoder available. No sign-up, 100% browser-based.
- urldecoder.org: Clean, reliable bidirectional tool. Supports decode each line separately and recursive decode options. Good UTF-8 handling. Requires button press for decode/encode. No URL parser or query parameter table. Good for quick batch decoding of multiple lines.
- urlencoder.org: Companion site to urldecoder.org, focused on encoding. Supports character set selection (UTF-8, ISO-8859-1), per-line encoding, and live mode for small inputs. No real-time output without live mode. No URL parser.
- url-encode-decode.com: Established tool with good educational content about URL encoding standards. Simple interface. Requires button press. No URL parser, no recursive decode, no encoding mode selection.
- meyerweb.com dencoder: Classic developer utility by Eric Meyer. Simple single-textarea interface. No button required for modern browsers. No parser, no encoding mode selection. Best for quick one-off decodes without configuration.
- jam.dev URL encoder: Clean modern interface with encode/decode toggle. Good character handling. No recursive decode, no URL parser or query parameter breakdown. Better UX than older tools but fewer features.
- kinde.com URL encoder/decoder: Developer-oriented tool with clean UI. Part of a broader developer toolset. No URL parser, no recursive decode option.
How to Choose the Right URL Decoder Tool
- For quick single-string decode: Any free browser-based tool works. Priority is instant output and clipboard copy. This tool, meyerweb.com dencoder, and jam.dev all provide clean, fast single-string decoding.
- For parsing query parameters: You need a tool with a URL parser that displays parameters as a key-value table. This tool is currently the only free URL decoder that provides this feature with decoded parameter values displayed as individual rows.
- For double-encoded URLs: You need a tool with explicit recursive decode support. This tool and urldecoder.org both provide recursive decoding. This tool reports the number of rounds applied.
- For encoding — encodeURIComponent vs encodeURI: You need a tool with an explicit mode selection for the two JavaScript encoding functions. This tool provides this selection explicitly; most other tools use one function without disclosing which.
- For form-encoded data (+ for spaces): You need a tool with a space encoding toggle. This tool's %20 / + toggle is specifically designed for this. Most other tools default to %20 only.
- For security research: Recursive decode and visibility into encoding rounds are critical features. This tool provides both. The URL parser also makes it easy to see whether a redirect URL contains encoded payloads in specific parameter values.
External Resources & Further Reading
- RFC 3986 — Uniform Resource Identifier (URI): Generic Syntax: rfc-editor.org/rfc/rfc3986 — the definitive IETF specification for URI syntax, including the complete definition of percent encoding, the reserved and unreserved character sets, and the rules for encoding each URI component. The authoritative reference for all URL encoding behaviour.
- MDN Web Docs — encodeURIComponent(): developer.mozilla.org — encodeURIComponent — the MDN reference for JavaScript's
encodeURIComponent()function, including the complete list of characters it does and does not encode, usage examples, and the important differences fromencodeURI(). - MDN Web Docs — URL API: developer.mozilla.org — URL API — documentation for the browser's native URL constructor and URLSearchParams interface — the recommended approach for constructing and parsing URLs in JavaScript without manual percent-encoding, including the same parsing logic this tool uses internally.
- WHATWG URL Living Standard: url.spec.whatwg.org — the WHATWG living standard for the URL format used by browsers. Defines the URL parsing algorithm, percent encoding rules, the URL API specification, and how browsers handle non-standard and partially-encoded URLs in practice.
- OWASP — URL Encoding / Double Encoding: owasp.org/www-community/Double_Encoding — OWASP's documentation on double encoding as a web security attack technique, explaining how double-encoded payloads are used to bypass input validation and web application firewalls, and how to detect and prevent such attacks.
- Google Search Console Help — URL Encoding in Sitemaps: developers.google.com — Build and submit a sitemap — Google's official guidance on URL encoding requirements in XML sitemaps, including which characters must be entity-escaped in the XML layer and which must be percent-encoded in the URL layer — a common source of encoding confusion in SEO practice.
Frequently Asked Questions
Q.What does URL decoding do?
Q.What is the difference between encodeURI and encodeURIComponent?
Q.Why does the decoded URL still show % characters?
Q.What is the URL Parser tab and how does it work?
Q.When should I use + vs %20 for spaces?
Q.How do I decode a URL with Chinese or Japanese characters?
Q.What is double encoding and why does it happen?
Q.Is my URL sent to a server when I use this tool?
Conclusion
URL encoding and decoding are fundamental operations in web development, data analysis, SEO, and security — yet the details of percent encoding, the difference between encoding functions, the handling of multi-byte Unicode characters, and the correct treatment of double-encoded URLs are consistently the source of bugs, confusion, and security issues.
This free URL decoder and encoder addresses every practical need: real-time bidirectional conversion with no button press, a full URL Component Parser that breaks URLs into labelled parts and renders query parameters as a decoded table, recursive decode for double-encoded URLs, explicit encodeURIComponent vs encodeURI mode selection, %20 vs + space encoding toggle, full UTF-8 Unicode support, and four real-world sample inputs. All of it runs in your browser — private, offline-capable, and with no data leaving your device.
Whether you are decoding a Japanese Wikipedia URL, parsing UTM campaign parameters, debugging a double-encoded API request, or encoding user input for safe inclusion in a query string — paste your URL and the decoded or encoded result is ready immediately.