ToolsForTexts
0 chars input0

Introduction to the URL Decoder and Encoder

Every developer, analyst, or SEO professional who works with web URLs has encountered percent-encoded strings — those sequences of %20, %3D, and %2F characters that make URLs look like gibberish. A URL like https://example.com/search?q=caf%C3%A9%20shop&city=New%20York is perfectly valid and functional, but its meaning is obscured by the encoding. Decoding it instantly reveals https://example.com/search?q=café shop&city=New York — the human-readable form that makes the query immediately understandable.

This free URL decoder and encoder handles both directions with precision. Decode any percent-encoded URL or string back to readable text — including multi-byte UTF-8 encoded characters like Chinese, Japanese, Arabic, and accented Latin characters. Encode plain text or URLs into percent-encoded format safe for web transmission. A built-in URL Component Parser breaks any full URL into its individual parts — scheme, host, path, query string, and fragment — and displays every query parameter as a decoded key-value table. Recursive decode handles double-encoded URLs. Four real-world sample inputs load immediately for exploration.

All processing runs in your browser using JavaScript's native decodeURIComponent() and encodeURIComponent() functions. No data is sent to any server. Real-time output updates as you type — no button press needed.

What This URL Decoder and Encoder Can Do

Bidirectional Decode and Encode

Switch between Decode URL (percent-encoded → readable) and Encode URL (plain text → percent-encoded) with a single click. Both directions update in real time as you type. No button press required — output is always live and current.

URL Component Parser with Query Parameter Table

Switch to the URL Parser tab to see any full URL broken into scheme, host, port, path, query, and fragment. All query parameters are decoded and displayed as a formatted key-value table — each parameter on its own row with its decoded key and decoded value.

Recursive Decode for Double-Encoded URLs

Enable Recursive Decode to automatically handle URLs encoded multiple times — such as %2520 (double-encoded space). The tool decodes up to 10 rounds, stopping when no further changes occur, and reports how many rounds were applied.

encodeURIComponent vs encodeURI Mode

In encode mode, choose between encodeURIComponent (encodes everything including / ? & = — correct for parameter values) and encodeURI (preserves URL structural characters — correct for encoding a full URL). The difference is critical for correct URL construction.

%20 vs + Space Encoding

Choose whether spaces encode as %20 (standard URI encoding, correct for paths and most query strings) or + (form-data encoding, used by HTML form submissions in application/x-www-form-urlencoded format). Toggle instantly without re-entering text.

Full Unicode / UTF-8 Support

Correctly decodes multi-byte UTF-8 percent-encoded sequences for any Unicode character — Chinese (%E4%B8%AD), Japanese (%E6%97%A5), Arabic, accented Latin (é = %C3%A9), emoji, and all other non-ASCII characters in URLs.

Four Real-World Sample Inputs

Load a simple encoded URL, a query string, a Japanese Wikipedia URL with UTF-8 encoding, or a double-encoded URL — each demonstrating a different practical use case. Click any sample button to load it immediately.

100% Browser-Based — Private & Real-Time

All decoding and encoding uses JavaScript's built-in functions locally in your browser. No data leaves your device. Works offline once the page has loaded. Safe for URLs containing sensitive parameters, API keys, and authentication tokens.

Who Is This URL Decoder Useful For?

  • Web developers and back-end engineers: Decode API request logs, debug URL-encoded form submissions, verify correct encoding of query parameters in API calls, and understand what data is being transmitted in encoded URL parameters.
  • Front-end developers: Debug URL construction in JavaScript, verify the correct use of encodeURIComponent() vs encodeURI(), decode URLs in browser history and navigation logs, and inspect the query parameters being passed to SPAs.
  • SEO professionals and digital marketers: Decode tracking URLs with UTM parameters, inspect encoded redirect destinations in campaign links, decode Google Analytics parameters, and verify that canonical URLs are correctly formed without encoding artifacts.
  • QA engineers and testers: Decode URL parameters in test logs and automated test output, verify that application URL construction is encoding parameters correctly, and debug cases where special characters in form inputs are mishandled.
  • Security researchers and penetration testers: Decode percent-encoded payloads in URL injection attempts, identify double-encoded sequences that might bypass input validation, and analyse URL-based attack vectors in security testing.
  • Data analysts and data engineers: Decode URL parameters in web analytics exports, server access logs, and click-tracking data to extract the original query values for analysis.
  • Content writers and editors: Decode readable text from encoded URLs in internal links, affiliate links, and shared URLs before including them in editorial content or documentation.
  • System administrators: Decode URLs in web server access logs, Nginx/Apache rewrite rules, and proxy configurations to understand what requests are actually being processed.

What Is URL Encoding and URL Decoding?

URL encoding — formally called percent encoding — is the mechanism defined in RFC 3986 for representing characters in a URI that would otherwise be ambiguous or invalid. The URL character set is restricted to a specific set of ASCII characters: the unreserved characters (letters, digits, hyphen, dot, underscore, tilde) that can appear in a URL without any special treatment, and the reserved characters (colon, slash, question mark, hash, ampersand, equals, etc.) that have structural meaning in URLs.

Any character outside this restricted set — including spaces, most punctuation, and all non-ASCII Unicode characters — must be percent-encoded before appearing in a URL. Percent encoding converts each byte of the character's UTF-8 representation to a three-character sequence: a literal percent sign (%) followed by two uppercase hexadecimal digits representing the byte value. The space character (ASCII 32, hex 0x20) becomes %20. The forward slash (ASCII 47, hex 0x2F) becomes %2F. The at sign (ASCII 64, hex 0x40) becomes %40.

For non-ASCII Unicode characters, the encoding is based on UTF-8 bytes rather than Unicode code points directly. The character é (U+00E9) encodes as the two UTF-8 bytes 0xC3 and 0xA9, producing %C3%A9. The Chinese character (U+4E2D) encodes as three UTF-8 bytes (0xE4, 0xB8, 0xAD), producing %E4%B8%AD. This means URLs from different locales contain multi-byte percent-encoded sequences that look cryptic but are entirely systematic — and this tool decodes all of them correctly.

URL decoding reverses this process: it replaces each %HH sequence with the corresponding byte value, then interprets the resulting byte sequence as UTF-8 to reconstruct the original Unicode characters. JavaScript's decodeURIComponent() performs this operation and is the function this tool uses internally.

The distinction between decoding and parsing is important. Decoding converts percent sequences to characters. Parsing understands URL structure — it separates the decoded URL into its functional components (scheme, authority, path, query, fragment) and further parses query strings into their individual key-value parameter pairs. This tool does both.

Benefits of Using a URL Decoder Tool

Instantly Readable URLs in Logs and Analytics

Web server access logs, Google Analytics exports, API gateway logs, and click-tracking systems all store URLs in their percent-encoded form. A log entry showing /search?q=caf%C3%A9%20latte&location=New%20York&sort=price_asc requires mental decoding to interpret. Pasting it into a URL decoder instantly reveals /search?q=café latte&location=New York&sort=price_asc — and the Query Parameter table further separates this into three labelled rows: q = café latte, location = New York, sort = price_asc.

For analysts working through thousands of log entries or campaign URLs, the ability to instantly decode and parse query parameters dramatically reduces the time needed to understand what queries are being executed, what campaign parameters are being tracked, and what data is being passed between application components.

For web developers debugging API calls, understanding the exact encoded form of parameters being sent to an API is critical. When a user's name "O'Brien & Co." appears as O%27Brien%20%26%20Co. in a network request, it is correct — but if it appears as O'Brien & Co. (unencoded), it is a bug that will break query string parsing in the receiving API. A URL encoder makes the correct form immediately visible for comparison.

For security testing, the ability to decode percent-encoded payloads — including double-encoded sequences — is essential for identifying URL-based injection attacks. A payload like %253Cscript%253E decodes in two rounds to <script>, demonstrating a double-encoded XSS attempt. The recursive decode option in this tool makes such sequences immediately identifiable.

For SEO and digital marketing, UTM campaign URLs and affiliate tracking links are typically URL-encoded when copied from platforms like Google Analytics, HubSpot, or affiliate networks. Decoding them reveals the actual campaign values, allowing verification that the correct parameters are being tracked and that special characters in campaign names (like & or +) are correctly encoded rather than creating parameter parsing ambiguity.

Why URL Encoding Matters in Web Development

URL encoding is not merely a technical formality — it is a fundamental security and correctness requirement for any web application that handles user input in URLs, query strings, or form data. The consequences of incorrect URL encoding range from broken functionality to critical security vulnerabilities.

The most common encoding-related bugs fall into predictable categories. Spaces in search queries that are not encoded cause the URL to break at the space — the browser or server interprets the space as a delimiter between separate URL components, truncating the query. Ampersands in parameter values that are not encoded as %26 are misinterpreted as parameter separators, splitting a single value into multiple incorrect parameters. Equals signs in parameter values that are not encoded as %3D are misinterpreted as key-value delimiters.

The distinction between encodeURIComponent() and encodeURI() in JavaScript — mirrored in the encoding mode options of this tool — reflects a deep technical requirement. encodeURI() preserves structural characters (/, ?, &, =, #, :) because it is designed to encode a complete URL while preserving its structure. encodeURIComponent() encodes everything including those structural characters — because individual parameter values should not contain unencoded characters that could be interpreted as URL structural elements. Confusing these two functions is one of the most common sources of encoding bugs in JavaScript applications.

For internationalisation, URL encoding enables URLs in any language. Without it, characters outside the ASCII set could not appear in URLs at all. With it, a URL pointing to a Japanese Wikipedia article, an Arabic news site, or a French e-commerce product page with accented characters is perfectly valid and can be transmitted over any HTTP infrastructure that expects ASCII text — because the non-ASCII characters have been percent-encoded to ASCII-safe sequences.

How to Use the URL Decoder and Encoder

1

Choose Decode or Encode Mode

Click 'Decode URL' to convert percent-encoded strings to readable text, or 'Encode URL' to convert plain text to percent-encoded format. Both modes update output in real time as you type — no button press needed.

2

Paste Your URL or Text

Paste any percent-encoded URL, query string, or encoded parameter value into the input panel. For encoding, paste plain text, a raw URL, or form data. Click any of the four sample buttons to load a real-world example immediately.

3

Enable Recursive Decode if Needed

If your URL appears to be encoded multiple times (you still see %25 sequences after decoding), enable Recursive Decode in the options panel. The tool will decode up to 10 rounds, stopping when no further changes occur. The stats bar reports how many rounds were applied.

4

Set Encoding Mode and Space Handling (for Encode)

In Encode mode, choose encodeURIComponent (encode all special chars, correct for parameter values) or encodeURI (preserve URL structural chars, correct for full URLs). Choose %20 or + for space encoding depending on whether you need URI or HTML form data format.

5

Switch to URL Parser Tab

Click the URL Parser tab in the output panel to see the full URL broken into its component parts — scheme, host, path, query, fragment. If the URL has query parameters, they appear as individual decoded key-value rows in the parameters table.

6

Copy or Download

Click Copy Result to copy the decoded or encoded text to your clipboard. Use individual component copy buttons in the URL Parser to copy specific parts. Click Download to save the output as a .txt file.

Common Use Cases for URL Decoding and Encoding

  • Decoding UTM campaign URLs: Marketing URLs with UTM parameters (utm_source, utm_medium, utm_campaign) often contain encoded campaign names with spaces and special characters. Decode them to verify the exact campaign values and check that all parameters are correctly formed.
  • Debugging API query strings: When an API request fails because a query parameter contains an unencoded special character, use the encoder to see the correct encoded form, or use the decoder to understand what a malformed encoded parameter actually contains.
  • Reading server access logs: Apache, Nginx, and other web server logs store request URLs in their encoded form. Decode individual log entries to understand what queries users are submitting, what pages they are requesting, and what parameters are being passed.
  • Decoding redirect URLs: Tracking pixels and link shorteners often encode the destination URL as a query parameter value. Decode the full redirect URL to see the actual destination — critical for security review of links before clicking them.
  • Parsing OAuth and SSO callback URLs: Authentication callbacks (OAuth 2.0, SAML, OpenID Connect) contain encoded parameters including state tokens, authorisation codes, and error messages. Decode and parse these URLs to debug authentication flows.
  • Extracting Google Search Console URLs: Google Search Console reports and API exports contain encoded search queries in URL format. Decode them to see the actual search terms that triggered impressions and clicks.
  • Encoding user-generated content for URLs: When building a URL that includes user-submitted data — a search term, a product name, a user bio — encode the value with encodeURIComponent() to ensure all special characters are safely represented without breaking URL parsing.
  • Debugging double-encoded URLs: Proxy servers, CDNs, and URL rewriting layers sometimes encode URLs that are already encoded, creating double-encoded sequences. Use Recursive Decode to unwrap all encoding layers and see the original URL.

Best Practices for URL Encoding

  • Always use encodeURIComponent() for parameter values: When constructing URLs in JavaScript by concatenating query parameter values, always encode each value with encodeURIComponent() — not encodeURI() and not manual string replacement. Only encodeURIComponent() correctly handles ampersands, equals signs, and other characters that have special meaning in query strings.
  • Do not double-encode: If a value is already percent-encoded, encoding it again creates double-encoding that most URL parsers will not correctly handle. Decode first to verify whether a value is already encoded before encoding it. The recursive decode option in this tool helps identify already-encoded values.
  • Decode for display, encode for transmission: The correct rule is: decode URLs for human-readable display in your UI, but always transmit encoded URLs over HTTP. Never display percent-encoded text to users when the decoded form is available and safe to show.
  • Use the URL constructor in JavaScript instead of manual encoding: The browser's built-in URL API and URLSearchParams handle encoding automatically and correctly. new URL(base) and url.searchParams.set(key, value) encode values correctly without the risk of manual encoding errors.
  • Understand the difference between + and %20: Both represent spaces, but in different contexts. %20 is the correct URI encoding for spaces in path segments and general query strings. + represents spaces only in application/x-www-form-urlencoded format (HTML form submissions). Using + in a path segment does not represent a space — it is a literal plus sign.
  • Validate decoded input server-side: Never treat a decoded URL parameter as safe input without validation. URL decoding is not a security mechanism — it simply restores the original characters, which may include injection payloads, SQL injection attempts, or XSS strings that were percent-encoded in the original request. Always validate and sanitise decoded input before processing.

Top URL Decoder Tools in the Market

  • This URL Decoder / Encoder (current tool): Bidirectional real-time decode and encode (no button press), URL Component Parser with query parameter table, recursive decode for double-encoded URLs, encodeURIComponent vs encodeURI mode, %20 vs + space encoding toggle, full UTF-8 Unicode support, four real-world samples. The most feature-complete free URL decoder available. No sign-up, 100% browser-based.
  • urldecoder.org: Clean, reliable bidirectional tool. Supports decode each line separately and recursive decode options. Good UTF-8 handling. Requires button press for decode/encode. No URL parser or query parameter table. Good for quick batch decoding of multiple lines.
  • urlencoder.org: Companion site to urldecoder.org, focused on encoding. Supports character set selection (UTF-8, ISO-8859-1), per-line encoding, and live mode for small inputs. No real-time output without live mode. No URL parser.
  • url-encode-decode.com: Established tool with good educational content about URL encoding standards. Simple interface. Requires button press. No URL parser, no recursive decode, no encoding mode selection.
  • meyerweb.com dencoder: Classic developer utility by Eric Meyer. Simple single-textarea interface. No button required for modern browsers. No parser, no encoding mode selection. Best for quick one-off decodes without configuration.
  • jam.dev URL encoder: Clean modern interface with encode/decode toggle. Good character handling. No recursive decode, no URL parser or query parameter breakdown. Better UX than older tools but fewer features.
  • kinde.com URL encoder/decoder: Developer-oriented tool with clean UI. Part of a broader developer toolset. No URL parser, no recursive decode option.

How to Choose the Right URL Decoder Tool

  • For quick single-string decode: Any free browser-based tool works. Priority is instant output and clipboard copy. This tool, meyerweb.com dencoder, and jam.dev all provide clean, fast single-string decoding.
  • For parsing query parameters: You need a tool with a URL parser that displays parameters as a key-value table. This tool is currently the only free URL decoder that provides this feature with decoded parameter values displayed as individual rows.
  • For double-encoded URLs: You need a tool with explicit recursive decode support. This tool and urldecoder.org both provide recursive decoding. This tool reports the number of rounds applied.
  • For encoding — encodeURIComponent vs encodeURI: You need a tool with an explicit mode selection for the two JavaScript encoding functions. This tool provides this selection explicitly; most other tools use one function without disclosing which.
  • For form-encoded data (+ for spaces): You need a tool with a space encoding toggle. This tool's %20 / + toggle is specifically designed for this. Most other tools default to %20 only.
  • For security research: Recursive decode and visibility into encoding rounds are critical features. This tool provides both. The URL parser also makes it easy to see whether a redirect URL contains encoded payloads in specific parameter values.

External Resources & Further Reading

  • RFC 3986 — Uniform Resource Identifier (URI): Generic Syntax: rfc-editor.org/rfc/rfc3986 — the definitive IETF specification for URI syntax, including the complete definition of percent encoding, the reserved and unreserved character sets, and the rules for encoding each URI component. The authoritative reference for all URL encoding behaviour.
  • MDN Web Docs — encodeURIComponent(): developer.mozilla.org — encodeURIComponent — the MDN reference for JavaScript's encodeURIComponent() function, including the complete list of characters it does and does not encode, usage examples, and the important differences from encodeURI().
  • MDN Web Docs — URL API: developer.mozilla.org — URL API — documentation for the browser's native URL constructor and URLSearchParams interface — the recommended approach for constructing and parsing URLs in JavaScript without manual percent-encoding, including the same parsing logic this tool uses internally.
  • WHATWG URL Living Standard: url.spec.whatwg.org — the WHATWG living standard for the URL format used by browsers. Defines the URL parsing algorithm, percent encoding rules, the URL API specification, and how browsers handle non-standard and partially-encoded URLs in practice.
  • OWASP — URL Encoding / Double Encoding: owasp.org/www-community/Double_Encoding — OWASP's documentation on double encoding as a web security attack technique, explaining how double-encoded payloads are used to bypass input validation and web application firewalls, and how to detect and prevent such attacks.
  • Google Search Console Help — URL Encoding in Sitemaps: developers.google.com — Build and submit a sitemap — Google's official guidance on URL encoding requirements in XML sitemaps, including which characters must be entity-escaped in the XML layer and which must be percent-encoded in the URL layer — a common source of encoding confusion in SEO practice.

Frequently Asked Questions

Q.What does URL decoding do?

A.
URL decoding converts percent-encoded sequences in a URL back to their original characters. Each %HH sequence (where HH is a two-digit hexadecimal value) is replaced by the corresponding byte value. For multi-byte UTF-8 encoded characters, multiple consecutive %HH sequences are combined and interpreted as a UTF-8 byte sequence to reconstruct the original Unicode character. For example, %C3%A9 decodes to é (the two UTF-8 bytes 0xC3 and 0xA9 represent U+00E9 in UTF-8).

Q.What is the difference between encodeURI and encodeURIComponent?

A.
encodeURI encodes a full URL but leaves characters that have structural meaning in URLs unencoded: :, /, ?, &, =, #, @, !, ', (, ), *, +, ,, ;. It is designed for encoding a complete URL while preserving its navigable structure. encodeURIComponent encodes all of these structural characters as well, leaving only unreserved characters (letters, digits, -, _, ., ~) unencoded. It is designed for encoding individual component values — particularly query parameter values — where structural characters must not appear unencoded.

Q.Why does the decoded URL still show % characters?

A.
This happens in two situations. First, the URL may be double-encoded — the % itself was encoded as %25, so decoding once produces %HH sequences rather than the original character. Enable Recursive Decode to decode multiple rounds and unwrap all encoding layers. Second, the URL may contain literal % characters that are not part of valid percent-encoded sequences — these are passed through unchanged because they cannot be decoded.

Q.What is the URL Parser tab and how does it work?

A.
The URL Parser tab takes your decoded URL and uses the browser's built-in URL constructor (same API browsers use to parse URLs internally) to split it into its components: scheme (http/https), hostname, port, pathname, query string, and fragment. It further parses the query string using URLSearchParams to extract individual key-value parameter pairs, decoding each key and value independently. Every parameter appears as its own row in the table with both the decoded key and decoded value.

Q.When should I use + vs %20 for spaces?

A.
Use %20 for spaces in URL path segments, and in query string values in most modern applications — it is the correct URI encoding defined in RFC 3986. Use + for spaces only when producing data in application/x-www-form-urlencoded format — the MIME type used by HTML form POST submissions. In this format, + specifically represents a space in the query string. Outside of form-encoded data, a + in a URL is a literal plus sign, not a space. Most modern web frameworks decode both %20 and + as spaces in query strings for compatibility, but only + is technically correct in the form-encoding standard.

Q.How do I decode a URL with Chinese or Japanese characters?

A.
Paste the percent-encoded URL into the input panel in Decode mode. Non-ASCII characters in URLs are encoded as their UTF-8 byte sequences in percent-encoded form. Japanese characters are typically 3 bytes each in UTF-8, producing 9-character sequences like %E6%97%A5. This tool correctly decodes all UTF-8 byte sequences and reconstructs the original Unicode characters from any script — Chinese, Japanese, Arabic, Korean, Thai, or any other language supported by Unicode.

Q.What is double encoding and why does it happen?

A.
Double encoding occurs when a URL that is already percent-encoded is encoded a second time. The percent sign (%) itself gets encoded as %25, turning %20 into %2520 and %2F into %252F. This commonly happens in proxy servers, CDN layers, URL rewriting engines, and logging middleware that encode URLs without first checking if they are already encoded. Some applications deliberately use double encoding to test input validation bypass. Enable Recursive Decode to handle double-encoded URLs by decoding them in multiple passes.

Q.Is my URL sent to a server when I use this tool?

A.
No. All decoding and encoding uses JavaScript's built-in functions (decodeURIComponent, encodeURIComponent, decodeURI, encodeURI, and the URL constructor) running locally in your browser. No data is sent to any server at any point. This tool is 100% private and works offline once the page has loaded — safe for URLs containing API keys, authentication tokens, and sensitive query parameters.

Conclusion

URL encoding and decoding are fundamental operations in web development, data analysis, SEO, and security — yet the details of percent encoding, the difference between encoding functions, the handling of multi-byte Unicode characters, and the correct treatment of double-encoded URLs are consistently the source of bugs, confusion, and security issues.

This free URL decoder and encoder addresses every practical need: real-time bidirectional conversion with no button press, a full URL Component Parser that breaks URLs into labelled parts and renders query parameters as a decoded table, recursive decode for double-encoded URLs, explicit encodeURIComponent vs encodeURI mode selection, %20 vs + space encoding toggle, full UTF-8 Unicode support, and four real-world sample inputs. All of it runs in your browser — private, offline-capable, and with no data leaving your device.

Whether you are decoding a Japanese Wikipedia URL, parsing UTM campaign parameters, debugging a double-encoded API request, or encoding user input for safe inclusion in a query string — paste your URL and the decoded or encoded result is ready immediately.