URL Decoder

URL Decoding Reference

What URL encoding is, when you need to decode, and how the same value can be decoded differently in different programming languages.

What is URL encoding?

URLs can only contain a small set of ASCII characters. Anything else — spaces, accented letters, emoji, symbols with special meaning like ? & = #, or bytes outside ASCII — must be written as %XX where XX is a two-digit hex pair. URL decoding is just the reverse: turning %20 back into a space, %C3%A9 back into é, and so on.

When do I actually need to decode?

• Reading a value out of a URL query string in your logs
• Debugging an email link, an OAuth redirect, or an SSO callback
• Inspecting tracking pixels in marketing tools
• Parsing a webhook payload that was sent as application/x-www-form-urlencoded
• Diffing two URLs to see what actually changed (decoded form is easier to read)

Full URL vs. value-only decoding

The two decoding modes in this tool correspond to the JavaScript built-ins decodeURI() and decodeURIComponent(). Full URL mode preserves URL-structural characters (/ : ? & = #) so the decoded result is still a valid URL. Value / parameter mode decodes everything — use it when your input is one piece extracted from a URL, like a single query value.

The + vs %20 question

In strict URL syntax, a literal + in a path or query is just a plus sign. But HTML forms submit data as application/x-www-form-urlencoded, where +is shorthand for a space. So if your input came from a form submission, an analytics pixel, or anywhere that calls itself "form-encoded", toggle Treat + as space. JavaScript's built-in decode functions do not do this for you.

URL encoding vs HTML entities

These are different things people often confuse. URL encoding looks like %26. HTML entities look like &. If you have & in your input, you need an HTML decoder, not a URL decoder. The two encodings can co-exist (HTML attributes hold URLs that hold percent-encoded values), but each layer has to be peeled with the right tool.

Decoding URLs in different languages

// Full URL (preserves syntax chars)
decodeURI('https://x.com/a%20b')

// Single value
decodeURIComponent('hello%20world')

// Form-encoded (+ is space)
new URLSearchParams('q=hello+world').get('q')

from urllib.parse import unquote, unquote_plus

# Standard percent decoding
unquote('hello%20world')        # 'hello world'

# Form-encoded (+ -> space)
unquote_plus('hello+world')     # 'hello world'

// Standard percent decoding
rawurldecode('hello%20world');

// Form-encoded (+ -> space)
urldecode('hello+world');

require 'cgi'
require 'uri'

URI.decode_www_form_component('hello+world')
# 'hello world'

CGI.unescape('hello+world')

import "net/url"

s, _ := url.QueryUnescape("hello+world")
// "hello world"

p, _ := url.PathUnescape("hello%20world")
// "hello world"

# With python
python3 -c "import sys, urllib.parse as p;
print(p.unquote(sys.argv[1]))" 'hello%20world'

# With jq
echo '"hello%20world"' | jq -r '@uri | .'

# Pure shell
printf '%b' "${input//%/\\x}"

Gotchas that bite developers