🔗 URL Decoder - Decode percent-encoded URLs online

🔧 Operation

📝 Input Text

📤 Output

⚠️ {{ error }}

ℹ️ About URL Encoding

URL encoding, or percent-encoding, replaces characters that are not allowed in a URI with the UTF-8 bytes of that character written as %HH hexadecimal escapes, so a space becomes %20 and & becomes %26. The escaping format is defined by RFC 3986; modern browser parsing and form-query behaviour are defined by the WHATWG URL Standard.

This tool is a URL component encoder and decoder with the exact semantics of JavaScript's encodeURIComponent() and decodeURIComponent(). Use it for API query strings, OAuth redirect_uri values, webhook callback URLs, mailto: links, object keys and routing parameters that contain spaces, delimiters, non-ASCII text or other characters with special meaning in a URL, and to decode percent-encoded links copied from logs, redirects or analytics tools.

Supported inputs

  • Operation: Encode URL (default) or Decode URL, chosen with the two buttons or the API field operation (encode or decode). The API requires both text and operation.
  • Encode: any text. Characters are converted to UTF-8 first, so accented letters and emoji are escaped byte by byte. Everything except A-Z, a-z, 0-9 and - _ . ! ~ * ' ( ) is escaped, including the delimiters : / ? # & = + @ ;, spaces and line breaks (%0A).
  • Decode: percent-encoded text. Every %HH sequence is turned back into a byte and the bytes are decoded as UTF-8. Unescaped characters, including +, are copied through unchanged.
  • The page converts on every keystroke; input that is empty or whitespace-only clears the output instead of producing a result.

Output

The converted string appears in the Output panel with a Copy Result button. Percent escapes are emitted in uppercase hexadecimal. When decoding fails, the output is cleared and an error line shows Error: Invalid input for URL decoding. The API returns JSON with success, input (the submitted text echoed back), operation and result; validation problems and malformed percent sequences return HTTP 400 with an error field.

Example

Hello World! encodes to Hello%20World!, and C++ & C# encodes to C%2B%2B%20%26%20C%23. A query value such as [email protected] becomes a%2Bb%40example.com; pasting the whole pair [email protected] gives email%3Da%2Bb%40example.com because the = is escaped too. Decoding %E4%BD%A0%E5%A5%BD returns the two UTF-8 characters 你好.

Limitations

  • Component encoding only. There is no "keep URL structure" mode: pasting https://example.com/a?b=c escapes :, /, ? and = and yields one opaque string. Encode each parameter name and value separately, then assemble the URL.
  • Not form encoding. Spaces are always %20, never +, and decoding leaves + as a literal plus sign rather than turning it into a space as application/x-www-form-urlencoded does.
  • ! * ' ( ) ~ are left unescaped, following the unescaped set of encodeURIComponent (the ECMAScript uriMark characters). Strict RFC 3986 encoders such as PHP's rawurlencode() also escape ! * ' ( ), so output can differ from those tools for these five characters.
  • Decoding is strict: a % not followed by two hexadecimal digits, or bytes that do not form valid UTF-8 (for example Latin-1 encoded %E9 on its own), is rejected instead of being passed through. Unpaired surrogate code units cannot be encoded and raise the same error.
  • The tool escapes and unescapes text; it does not parse, validate or normalise the URL, its host, or its path.
  • URL encoding is not encryption or input validation. Encoded secrets still appear in browser history, server logs, referrer headers and analytics tools.

Browser or server processing

The interactive tool runs in the browser through the shared logic module (url-encoding.logic.js); nothing you type on this page leaves your device. The public API runs the same module on the server, so only the API path sends text to the server, and the result is identical in both places.

FAQ

Why is a space encoded as %20 and not +?

%20 is the RFC 3986 escape for a space and is valid anywhere in a URL, while + means space only inside application/x-www-form-urlencoded data such as HTML form bodies. This tool always emits %20 and escapes a real plus as %2B, so the result is unambiguous for both readers.

Should I encode the whole URL or only the query value?

Only the value, the name, or a single path segment; a complete URL loses its structure because the delimiters are escaped too. Encoding a full URL is correct only when the URL itself is a parameter value, such as a redirect_uri or return URL.

Why does decoding fail with a % error?

The decoder requires every % to start a two-digit hexadecimal escape and the resulting bytes to be valid UTF-8. A literal percent sign (100%), a truncated sequence (%E0%A4%A) or a single-byte Latin-1 escape (%E9) all trigger Invalid input for URL decoding. Write a literal percent as %25 before decoding; text encoded from Latin-1 must be decoded with a Latin-1 aware tool.

Does the tool handle accented characters and emoji?

Yes. Input is treated as UTF-8, so café encodes to caf%C3%A9 and a four-byte emoji becomes four %HH escapes. Decoding the escapes restores the original characters.

References

API Usage Example:

POST /api/tools/encoding-decoding/url
Content-Type: application/json

{
    "text": "Hello World!",
    "operation": "encode"
}
Ready