URL Decoder

URL Decoder

Paste an encoded link or value into Encoded text or URL, or load the Example, and choose how to read it:

• Decode as a whole URL: readable form, plus every part on its own. You get the link as a person would read it, and below that each part decoded separately: scheme, credentials, host, port, path, query and fragment.
• A value (a query string or a path segment). For a single piece of a URL, everything is decoded, including %26 (&), %3D (=), %2F (/) and %3F (?).

The result appears under Decoded, with Copy and Use the result as input. A table lists every escape that was decoded, with its character and how often it appeared. Clear starts over.

Decoding happens in your browser; nothing you paste is sent or stored.

Example: a link that’s seen some history

https://xn--bcher-kva.example/caf%C3%A9/?q=salt%20%26%20pepper&ref=news+letter&old=caf%E9#top

The readable form is:

https://xn--bcher-kva.example/café/?q=salt & pepper&ref=news+letter&old=café#top

The summary reads 6 percent escapes decoded in 1 pass, 93 characters in, 80 out. é written as %C3%A9 counts as two escapes, because it’s two bytes.

The URL, part by part shows the scheme https, the host bücher.example (written xn--bcher-kva.example, Punycode), the path /café/, the query and the fragment #top. The query parameters get a table of their own:

What was decoded lists each escape:

Both %C3%A9 and %E9 became é, but by different routes, as the sections below explain. Each part of this link shows one of the tool’s rules at work.

The query is split before it’s decoded

Look at the readable form again: ?q=salt & pepper&ref=…. Read naively, that’s a parameter q = “salt “, then something called “ pepper”. But in the original link the & inside the value was encoded as %26, so it belongs to the value.

That’s why the part-by-part view splits the query at the real & and = signs first, and only then decodes each value on its own. The parameter table gives the exact meaning, even when a decoded value contains & or =. The readable form is for reading. When you need the values, for a report, a spreadsheet or debugging, take them from the table.

Old escapes: Windows-1252

Modern URLs encode text as UTF-8, so é is %C3%A9. But older sites, servers and log files often used Windows-1252, the old web encoding, where é is a single byte, %E9. Strict decoders choke on that. JavaScript’s decodeURIComponent() stops with “URI malformed”, and others print � in its place.

This decoder works byte by byte instead. Valid UTF-8 sequences become their characters, and any other byte is read as Windows-1252. So %E9 becomes é and %96 becomes an en dash (–) instead of garbage. A note lists every escape that was read this way, so you know which parts of the link came from the old encoding.

Broken escapes stay as written

A link that’s been mangled, by being cut short, retyped, or passed through a system that doesn’t understand it, can contain escapes that aren’t valid: %zz, a lone % at the end, or “100%” written without encoding. Instead of failing on the whole link, the decoder leaves those exactly as written, lists them, and decodes everything else. You get as much of the link back as there is to get.

When a + is a space

A + means a space in exactly one place: a query string in the format HTML forms submit. Everywhere else it’s a plus sign. So the tool only turns + into a space when A + means a space (form style; in a URL only inside the query) is ticked, and in a whole URL only inside the query.

In the example, ref=news+letter stays “news+letter” with the option off, and becomes “news letter” with it on. A + in a path, like /C++/, stays a plus sign either way. If you’re not sure, look at where the link came from: search forms and older sites use + for spaces, while most other links use %20.

Punycode domains

The readable form keeps the domain exactly as written, xn--bcher-kva.example, so you can copy a working link. The part-by-part view shows what it says: bücher.example.

Seeing both matters with suspicious links. A Punycode domain can be built to look exactly like a familiar one, using a Cyrillic "а" in place of a Latin “a”. The IDN/Punycode Phishing Detector checks a domain for that kind of lookalike, and Punycode to Unicode converts any label.

Double-encoded links

A link encoded twice decodes, in one pass, to something still full of escapes: Spring%2520Sale becomes Spring%20Sale. The tool warns when the result still contains escapes and offers a second pass in one click, which gives “Spring Sale”.

For links encoded several times over, which redirect chains and tracking systems sometimes produce, tick Decode repeatedly until nothing is left (double-encoded text). The result reports how many passes it took. Decoding once is the default because some values are meant to contain a %: decoding them again would change what they say.

Where it’s useful

• Seeing where a link really goes. Tracking and redirect links hide the destination in a parameter, like ?url=https%3A%2F%2F…. Decode the link and read the parameter table to see the real address before you click.
• Reading analytics and logs. Page paths with accents, search terms and UTM values arrive encoded in reports and server logs. Decoding them shows what visitors actually searched for or landed on.
• Fixing broken links. A link that fails because of a stray % or a double encoding shows its problem here: broken escapes are listed, and double encoding is flagged.
• Debugging API requests. Split the query to check that every parameter arrives with the value you expect, with & and = inside values kept apart from the real separators.

FAQ

Is decoding the same as unshortening a link?

No. A short link like bit.ly/abc only reveals its destination when you follow the redirect, and the decoder doesn’t visit anything. Decoding changes how a link is written, not where it leads. It does reveal destinations that are only hidden by encoding, as in redirect parameters.

Does it handle other alphabets and emoji?

Yes. Any valid UTF-8 sequence becomes its character, whether Cyrillic, Chinese, Arabic or emoji. %F0%9F%98%80 is 😀.

Why does my result show strange characters?

The link was probably encoded in UTF-8 and then decoded as something else somewhere along the way, or the reverse. Check the note about Windows-1252 escapes, and try Use the result as input if the text looks double-encoded.

How do I encode text for a URL?

Use the URL Encoder. It encodes a whole link part by part, or a single value.