URL Decode String

URLs can only carry a small set of characters, so everything else is written as a % followed by two hex digits. This is called URL encoding or percent-encoding. Decoding turns the codes back into the characters they stand for:

1. Find each % followed by two hex digits (0–9, A–F) and replace it with that character: %20 is a space, %2F is /, %3F is ?.
2. Put multi-byte characters back together. Letters outside basic English take two to four codes in a row, so %C3%A9 is one é and %E2%82%AC is one €.
3. If the text came from a form or a search box, turn each + into a space as well.

Everything else, such as letters, digits and - . _ ~, stays as it is. The tool above does all three steps as you type. Upper and lower case codes mean the same thing, so %2f is also a slash.

These are the codes you will meet most often in links, search URLs and redirect parameters:

Any code from %00 to %7F is a single ASCII character. Codes from %C2 upward start a multi-byte character, so they always come in groups of two, three or four.

Both, depending on where the text came from. In the path of a URL a space is always %20. In a query string built by an HTML form or a search box, such as ?q=summer+sale, a space is written +. A real plus sign is then sent as %2B.

The tool reads + as a space by default because most pasted strings are search and form URLs. Turn off + means space if your text is a path or a value that really contains plus signs, such as a phone number like +44. Note that some code functions keep the plus: JavaScript’s decodeURIComponent and Python’s unquote leave summer+sale unchanged (see the code below).

Links that pass through redirects, email trackers or log files are often encoded again at every step. Each layer turns the % of the one before into %25, so %2520 is a space encoded twice. When the result still has codes in it, the tool says so and offers to decode all layers. For garbled letters like é and ’, use the UTF-8 Decode tool, which repairs them.

Decoding a whole URL at once can also hide its structure: in ?next=%2Forders%3Fpage%3D2&lang=en the decoded page=2 looks like a separate parameter. Open Query parameters under the result to see each value decoded on its own, so next is /orders?page=2.

decodeURIComponent(s)                        // JavaScript: keeps +
decodeURIComponent(s.replace(/\+/g, ' '))     // JavaScript: + as space

urllib.parse.unquote(s)                      # Python: keeps +
urllib.parse.unquote_plus(s)                 # Python: + as space

rawurldecode($s);                            // PHP: keeps +
urldecode($s);                               // PHP: + as space

URLDecoder.decode(s, StandardCharsets.UTF_8) // Java: + as space

Uri.UnescapeDataString(s)                    // C#: keeps +
WebUtility.UrlDecode(s)                      // C#: + as space

In JavaScript, use decodeURIComponent rather than decodeURI. decodeURI is meant for whole addresses and leaves codes like %2F, %26 and %3F undecoded, so the result can look half done.

The functions also differ on a stray %: JavaScript throws “URI malformed” and Java throws an IllegalArgumentException, while Python, PHP and C# leave it as it is. Each call undoes one layer, so call it again for text that was encoded twice.