URL Decoder

Introduction

Percent-encoded URLs look like noise in logs: %20 instead of spaces, %E4%B8%AD instead of Chinese characters, %252F from double-encoding mistakes. Before you can debug a broken redirect, reproduce a customer's search link, or extract the original query parameter from an access log line, you need to reverse the encoding safely and read the human-readable text underneath.

Certoflow's URL Decoder converts percent-encoded strings back to readable UTF-8 text entirely in your browser. Paste an encoded URL, query fragment, or isolated component and receive decoded output. No data uploads — OAuth callbacks, signed URLs with embedded tokens, and internal analytics parameters stay on your device.

What this tool does

The decoder reverses percent-encoding operations:

Input type	Example encoded	Decoded
Space	hello%20world	hello world
Ampersand in value	Q%26A	Q&A
UTF-8 unicode	%C3%A9%20l%C3%A0	é là
Plus form encoding	spring+sale	spring sale (when plus-as-space enabled)

Features include paste, copy decoded result, example loading, clear, and error states for malformed sequences like incomplete %2 or invalid hex digits.

How it works

Decoding scans for % followed by two hexadecimal digits (and optionally handles + as space for form-urlencoded input):

decodeURIComponent('hello%20world');
// "hello world"

decodeURI('https://example.com/path?q=hello%20world');
// "https://example.com/path?q=hello world"

Client-side pipeline:

1. Normalize — trim input, optionally convert + to space for form-style strings.
2. Parse escapes — replace %XX with corresponding byte values.
3. UTF-8 decode — interpret byte sequence as UTF-8 text.
4. Output — display readable string; malformed sequences throw catchable errors.

Invalid sequences surface clearly:

URIError: URI malformed

Common causes: truncated %, non-hex characters after %, or invalid UTF-8 byte sequences from manual encoding errors.

No server communication. Decoding is synchronous for typical strings.

decodeURI vs decodeURIComponent

Function	Decodes	Preserves encoded structure
decodeURI	Escapes in full URI	Leaves %2F, %3F in paths if encoded
decodeURIComponent	All component escapes	Fully decodes parameter values

Match decoder to what you encoded originally.

Real-world examples

Reading Apache access log query strings

Log line contains:

GET /search?q=node.js%20%26%20npm HTTP/1.1

Decode node.js%20%26%20npm → node.js & npm — the user's actual search intent.

Debugging OAuth redirect loops

Callback URL arrives over-encoded:

next=%252Fdashboard

First decode: %2Fdashboard. Second decode (if double-encoded): /dashboard. Identifying double-encoding fixes Next.js redirect middleware.

Extracting UTM campaign from marketing link

?utm_campaign=spring%20sale%202024

Decode value to spring sale 2024 for CRM attribution records.

International slug inspection

Path segment %E6%97%A5%E6%9C%AC%E8%AA%9E decodes to 日本語 — verify CMS slug generation for Japanese product pages.

Slack webhook URL parameters

Incoming webhook URLs embed tokens as path or query segments. Decode surrounding parameters to confirm routing without exposing full secrets in tickets — redact after inspection.

Reverse-engineering API client URLs

Mobile app captures show encoded filter JSON in query params:

filters=%7B%22status%22%3A%22active%22%7D

Decode to {"status":"active"} — reveals client-side filter construction.

Common mistakes

Decoding full URLs with decodeURIComponent. May decode structural characters that should remain encoded, breaking re-fetch. Use decodeURI for full URLs or decode known components only.

Single decode on double-encoded input. %2520 becomes %20 after one pass — still encoded. Decode iteratively until stable or compare against expected plaintext.

Assuming plus always means space. Plus-as-space applies to application/x-www-form-urlencoded, not all URI contexts. Raw %20 and + differ in query strings vs path segments.

Ignoring charset. Bytes %C3%A9 are UTF-8 for é. Interpreting as Latin-1 produces wrong characters.

Decoding untrusted URLs then visiting them. Decoding for inspection is safe locally; opening malicious decoded URLs in browser is not. Inspect without navigating.

Expecting decoding to validate URL safety. javascript:alert(1) decodes fine — semantic safety requires separate checks.

Mixing encoded path with unencoded query. Partial decoding produces inconsistent URLs. Decode component-by-component when rebuilding.

Use cases

Frontend developers debugging router params, query string parsers, and SSR request URL reconstruction.

Backend developers reading reverse proxy access logs and reconstructing original client intent.

Support engineers translating customer-provided encoded links into readable form for bug reproduction.

Security analysts inspecting encoded payloads in WAF logs without sending samples to external services.

SEO specialists verifying decoded hreflang and campaign parameters match intended locale targeting.

Students connecting percent notation to UTF-8 byte representations in networking courses.

FAQ

Is my URL sent to a server?

No. Decoding runs entirely in your browser.

Why do I get "URI malformed"?

Incomplete % sequences, invalid hex digits, or corrupted UTF-8 bytes. Check source copy-paste truncation.

Should I decode once or twice?

Decode until output stops changing if double-encoding is suspected. Compare against known expected text.

Does the decoder handle + as space?

Form-urlencoded strings use +. Enable or apply plus handling when decoding query strings from HTML forms.

What's the difference between URL Decoder and URL Encoder?

Inverse operations. Encode before transmission; decode after receipt or for log inspection. Round-trip verifies correctness.

Can I decode a complete URL at once?

Yes with decodeURI. For precise control, parse URL structure and decode each component separately.

Will decoding break my URL for reuse?

Full decoding may remove encoding required for valid HTTP requests. Keep encoded version for fetching; use decoded for reading.

How do I decode Base64 in URLs?

Base64 is separate from percent-encoding. Some JWT or state params are Base64URL — use JWT Decoder after extracting the parameter.

Can I decode non-UTF-8 encodings?

This tool assumes UTF-8, the web standard. Legacy encodings may produce mojibake.

Can I use this offline?

Yes, after initial page load.