What Is URL Decoding?
URL decoding is the process of converting percent-encoded sequences back into their original characters. When you see a URL containing strings like %20, %3D, or %E2%82%AC, those are encoded representations of a space, an equals sign, and the Euro symbol respectively. Decoding reverses the encoding process and returns the human-readable form of the URL or query string.
Browsers decode URLs automatically before displaying them in the address bar, which is why you see readable text rather than percent sequences when you visit a page. However, when you work with raw API responses, log files, redirect chains, or URL parameters in code, you often need to decode them manually to understand what data is being passed.
Standard Decoding vs Form-Encoded Decoding
There are two conventions for encoding spaces in URLs, and decoding the wrong way produces incorrect output:
Standard Percent-Encoding (RFC 3986)
In standard URL encoding, a space is always represented as %20. This is what browsers use in the address bar, what encodeURIComponent and encodeURI produce in JavaScript, and what most modern APIs and frameworks use. When decoding standard percent-encoded URLs, a plus sign (+) is treated as a literal plus character, not a space.
Form-Encoded (application/x-www-form-urlencoded)
HTML forms submitted via the GET method use a slightly different encoding scheme where spaces are encoded as plus signs (+) instead of %20. This is the format you see in traditional search engine URLs: https://example.com/search?q=hello+world. When decoding form-encoded strings, you must first convert + to space before running the standard percent-decode. Use the Form encoded mode on this tool when decoding query strings that came from HTML form submissions.
Common Percent-Encoded Sequences Reference
| Encoded | Character | Description |
|---|---|---|
%20 | Space | Most frequently seen sequence |
%21 | ! | Exclamation mark |
%22 | " | Double quote |
%23 | # | Hash / fragment |
%25 | % | Percent sign itself |
%26 | & | Ampersand |
%2B | + | Plus sign (literal) |
%2F | / | Forward slash |
%3A | : | Colon |
%3D | = | Equals sign |
%3F | ? | Question mark |
%40 | @ | At sign |
%5B | [ | Opening bracket |
%5D | ] | Closing bracket |
%7B | { | Opening brace |
%7C | | | Pipe |
%7D | } | Closing brace |
%C3%A9 | é | Accented e (UTF-8 multi-byte) |
%E2%82%AC | € | Euro sign (UTF-8 multi-byte) |
Practical Situations Where You Need URL Decoding
Reading Server Access Logs
Web server access logs (Apache, Nginx, Cloudflare) record raw request URLs in percent-encoded form. A log entry like GET /search?q=best%20coffee%20shops%20in%20NYC is much easier to analyze after decoding the query string to best coffee shops in NYC. URL decoding log data is essential for understanding user search behavior, debugging 404 errors, and auditing redirect chains.
Debugging API Responses and Redirects
APIs frequently return URLs in responses — redirect locations, next-page links, asset URLs, and callback URIs. When these contain percent-encoded sequences, decoding them makes it immediately clear what endpoint or resource is being referenced. Decoding also helps verify that your application is correctly encoding its outgoing requests by checking the round-trip: encode then decode should return the original input unchanged.
Parsing Query Parameters From User-Shared Links
When users copy URLs from their browser and share them in support tickets, emails, or bug reports, the URLs often contain encoded parameters. Decoding these URLs quickly reveals the exact state of the application — search terms, filter values, page numbers, and user IDs — without needing to reproduce the scenario manually.
Working With OAuth Callback URLs
OAuth flows pass encoded redirect URIs and state parameters through multiple hops. Decoding these strings helps verify that the correct callback URL was registered and that the state parameter was not tampered with during the authorization flow.
Understanding Multi-Byte Unicode Decoding
Non-ASCII characters such as Chinese, Arabic, Japanese, Greek, and emoji require multiple bytes to represent in UTF-8. Each byte is separately percent-encoded. The Japanese character 日 (sun/day) is stored as three bytes in UTF-8 — E6, 97, — and appears in a URL as %E6%97%A5. Similarly, the emoji 🎉 encodes to %F0%9F%8E%89 across four bytes. This tool correctly reconstructs the original Unicode character from all multi-byte sequences, giving you the readable character instead of garbled output.
What Causes “Malformed URI” Errors?
A malformed URI error during decoding is usually caused by one of three issues. First, a bare percent sign that is not followed by two valid hexadecimal digits — for example, 100% in a URL is invalid because the % is not followed by hex digits. Second, invalid UTF-8 sequences that form structurally correct percent-encoded bytes but do not map to a valid Unicode code point. Third, double-encoded strings where a percent sign was itself encoded as %25, producing sequences like %2520 which decodes to %20 instead of a space. If you encounter an error, check your input for bare percent signs or copy the URL directly from the browser address bar to ensure it is in its native encoded form.