URL Decode
This free online URL decoder turns percent-encoded strings back into plain, readable text the moment you paste them.
How to use
- Paste the percent-encoded string into the editor below.
- The decoded text appears instantly; malformed % sequences are reported clearly instead of decoded into garbage.
- Copy the result — it was produced on your device and never left your browser.
Frequently asked questions
Why do I get an error about a malformed % sequence?
A percent sign must start a valid escape: a % followed by two hex digits. A dangling % at the end, %G0 with non-hex characters, or a truncated multi-byte sequence fails with a clear message — that usually means the string was cut off mid-escape during copying.
Does + become a space when decoding?
No, deliberately. In the percent-encoding convention a plus sign is a literal plus; only %20 decodes to a space. Strings that use + for spaces come from HTML form encoding — convert the plus signs to %20 first if that is your case.
The result still looks encoded, like %2520. What now?
That is double encoding: %25 is itself the escape for %, so %2520 decodes to %20, not to a space. Paste the result back into the decoder a second time — keep decoding until you see plain text.
Is decoding sensitive URLs here safe?
Yes — decoding runs locally in your browser. Logged URLs, tokens and captured parameters never leave your device, are never stored or logged, and are gone when you close the page.
Related tools
About this tool
This free online URL decoder turns percent-encoded strings back into plain, readable text the moment you paste them. It is built for reading what actually arrived in a server log line, debugging a query string your analytics tool captured, recovering a Chinese keyword from a tracking link, and inspecting redirect parameters before you trust where a link really goes. Decoded output preserves your data exactly: %20 becomes a space, %E4%B8%AD becomes 中, and every byte sequence is interpreted as UTF-8 so mixed-language text survives intact. Malformed input is treated honestly: a dangling % at the end, a %G sequence with invalid hex digits, or a truncated multi-byte escape produces a clear error message instead of a silently mangled string — when a URL fails to decode, you need to know where, not receive plausible garbage. Decoding runs entirely in your browser: logged URLs, tokens and captured parameters are processed locally on your own device and never uploaded, stored or logged. Paste the encoded string below and read what it really says.