URL Decoder
Turn a wall of percent escapes back into readable text so you can see what a URL actually contains.
Your data stays on your device
Input — Encoded
- characters
- 0
- lines
- 0
- size
- 0 B
Output — Text
- characters
- 0
- lines
- 0
- size
- 0 B
Options
For values that were encoded more than once, such as %2520.
About this tool
A redirect chain or an OAuth callback often carries a URL inside a URL, encoded once for each hop. The result is unreadable, and the only way to understand it is to decode — sometimes more than once.
This decoder handles multi-byte UTF-8 sequences correctly, treats + as a space where appropriate, and offers repeated decoding for values that were encoded several times. Malformed escapes are left as-is instead of aborting the whole operation.
How to use this tool
- Paste the encoded URL or parameter value.
- Choose whether + should be treated as a space.
- Enable repeated decoding if the value was encoded more than once.
- Press Decode and read the result.
Key features
- Correct multi-byte UTF-8 decoding
- Optional plus-as-space handling
- Repeated decoding with a configurable pass limit
- Malformed escape sequences preserved rather than throwing
- Line-by-line decoding for bulk values
- A count of how many decoding passes were applied
Example
Input — Encoded text
next%3Dhttps%253A%252F%252Fex.comOutput — Text
next=https%3A%2F%2Fex.comGood to know
- Repeated decoding can over-decode a value that legitimately contains a percent sign; use it deliberately.
- Decoding does not validate that the result is a well-formed URL.
- Invalid byte sequences cannot always be resolved to text and are reported as such.
Frequently asked questions
Why do I sometimes need to decode twice?
Because the value was encoded twice — typical when a URL is embedded as a parameter inside another URL and each layer encoded it independently.
What does %25 mean?
It is an encoded percent sign. Seeing %2520 is the classic signature of a double-encoded space.
Should + become a space?
Yes for form-encoded query strings. No for a path segment, where + is a literal plus character.
Is it safe to decode a URL containing a token?
The decoding happens locally and nothing is sent anywhere. As a general habit, still avoid pasting production credentials into any tool.
Your data stays on your device
Your data is processed locally in your browser and is not uploaded to our server. This page keeps working after you go offline, because there is nothing to send.