CleanorTools
URL

URL Decode

Details

How to use URL Decode

What the tool does, how to run it, and what to expect from the result.

How to decode a percent-encoded URL string

Percent-encoded strings turn up everywhere: in server logs, in redirect parameters, in analytics reports, and in error messages. Decoding turns %20 back into a space and %3A back into a colon so you can read what a URL was actually carrying.

The decoder reverses percent-encoding and nothing else. It will not silently turn plus signs into spaces, and it will refuse a malformed escape sequence rather than produce a wrong answer quietly.

  • Paste the percent-encoded string into the input box.
  • If the string came from an HTML form submission, replace plus signs with spaces before decoding.
  • Read the decoded text in the output panel.
  • If you still see percent sequences after decoding, the value was double-encoded, so decode the result a second time.
  • Escape the decoded value again before putting it into HTML, SQL, or a shell, because decoding removed the protection the encoding gave it.
Tips

Getting a better result out of URL Decode

Specific settings and thresholds, not general advice.

  • This does not turn plus signs into spaces. It reverses percent-encoding only. If your string came from an HTML form body, the plus signs are spaces and you need to replace them yourself before decoding, or you will see plus signs in the middle of your words.
  • A lone percent sign is an error, not a literal. Decoding a string such as 100% off fails, because the decoder expects two hex digits after every percent sign. A real percent character has to be written as %25.
  • Decode exactly once. If you see a sequence such as %2520, the value was encoded twice (the percent itself became %25), which usually means a URL passed through two layers that each helpfully encoded it. Decode it twice to recover the original, then go fix the layer that double-encoded.
  • Percent-encoded bytes are decoded as UTF-8. A sequence like %C3%A9 is two bytes that together mean a single accented e. If you see two odd characters where one accented letter should be, the string was encoded as UTF-8 and decoded as Latin-1 somewhere upstream.
  • Decoding untrusted input can reveal characters you then have to handle again. A decoded value may contain angle brackets, quotes, or newlines, so escape it for its next destination rather than assuming that decoding made it safe.
Limits

What URL Decode does not do

The honest boundary, so you do not lose time finding it yourself.

  • It does not convert plus signs to spaces, so form-encoded bodies need that substitution done first.
  • It fails rather than guessing on malformed input, including a bare percent sign or a truncated escape sequence.
  • It does not split a query string into parameters. To see a URL broken into its host, path, and named parameters, use the URL parser instead.
  • It assumes UTF-8. Percent sequences produced by an older Latin-1 system will decode to the wrong characters.
At a glance

Who URL Decode is for

A quick way to understand who this helps, what it solves, and where it connects next.

Best fit

Developers, engineers, and anyone working with encoded data.

Ideal for

Quick encoding, decoding, and inspection without a backend or install.

FAQ

Common questions

Short answers for the questions people usually have before trying a utility like this.

Is the URL decoder free?

Yes. It is completely free to use, with no signup, no account, and no paywall.

Do I need to install anything?

No. It runs in any modern browser on desktop or mobile, with nothing to download and nothing to configure.

Does it stay local?

Yes. The text you paste is processed entirely in your browser and never uploaded to a server.

Why do plus signs stay as plus signs?

Because in a URL a plus sign is a plus sign. The convention that a plus means a space belongs specifically to the application/x-www-form-urlencoded media type, which is what a classic HTML form POST body uses, and it does not apply to URLs generally. This tool reverses percent-encoding faithfully, which means it cannot guess whether your plus signs were spaces or genuine plus characters. If you know the string came from a form body, replace plus with a space first.

Decoding failed on my string. Why?

The most common reason is a percent sign that is not followed by two valid hexadecimal digits, which makes the sequence malformed. This happens with strings that contain a literal percent character (such as a discount code) that was never encoded in the first place. It also happens when a string has been truncated mid-escape, leaving something like %2 at the end. The decoder refuses to guess, so it reports an error rather than returning a plausible but wrong result.

What does %2520 mean?

It is a double-encoded space. A space becomes %20, and if that string gets percent-encoded a second time, the percent sign itself becomes %25, giving %2520. Seeing this is a reliable sign that a URL passed through two layers that each encoded it, which typically happens when a redirect parameter is built by one service and then re-encoded by another. Decode twice to recover the original, then remove the duplicate encoding step in the pipeline.

Is decoding safe for untrusted input?

Decoding itself is safe, but the result is not. Percent-encoding is often what was preventing a hostile value from breaking out of the query string, and once you decode it you may be holding a string full of angle brackets, quotes, or control characters. Escape it again for whatever context it goes into next, whether that is HTML, SQL, or a shell command.

Does anything get uploaded?

No. The decode is one local JavaScript call that runs in your browser. URLs frequently carry session identifiers and signed tokens, so keeping them off the network is the point.

Recommendations

You Might Also Like

Nearby tools from the catalog that fit the same job or workflow.

DEC
UtilityLinks

URL Decoder

Decode encoded URLs

Decode URL-encoded strings, query values, and path segments into readable text locally.

URL
UtilityURL

URL Encode

URL-encode text

Percent-encode text so it is safe to use in a URL or query string. Free, in your browser, nothing is uploaded.

URL
UtilityURL

URL Parser

Parse a URL into parts

Break a URL into its protocol, host, port, path, query parameters, and hash. Free, in your browser, nothing is uploaded.

ENC
UtilityLinks

URL Encoder

Encode URL-safe text

Encode plain text for safe use inside full URLs, query strings, query values, and path segments.

B64
UtilityBase64

Base64 Decode

Decode Base64 to text

Decode a Base64 string back into readable text. Free, in your browser, nothing is uploaded.

IMG
UtilityBase64

Base64 to Image

Base64 to image

Decode a Base64 string or data URL back into an image, preview it, and download it locally.

Cleanor app

Do it all on your device

Cleanor puts these tools in one app: compress and convert images, video, and audio, work with PDFs, and scan text right on your device. Plus free up storage and clear inbox clutter with Email Cleaner. Start with a free trial.

  • iPhone
  • Android
  • Macsoon
  • Windowssoon
Get it on the App StoreGet it on Google PlayAll platforms & pricing