Skip to content

URL Decoder

Decode one percent-encoded URI or form field component with explicit plus handling, strict malformed-input errors, and inert output.

Use this result well

Inputs that matter
One percent-encoded component and the decoding context for literal plus signs.
Output to expect
Decoded text, with feedback for invalid percent-encoded sequences.
How it works
Decoding treats + literally in URI-component mode and as a space in form-urlencoded mode.
  • Apply component encoding to a path segment or parameter value, not an entire URL whose separators must remain meaningful.
  • Decode only the intended layer. The decoded text is shown for review; its contents are not evidence that a destination is trustworthy.
  • Text input is limited to 2,000,000 UTF-16 units and each result to 20,000,000. Large conversions can be cancelled or retried.

Choose your path

Built around the job you need to finish

Decode exactly one percent-encoded component under an explicit URI-component or form-urlencoded-field context, preserving literal plus where required and rendering the result only as untrusted text.

Developer debugging a received query or path value

Decode one component after structural parsing without turning reserved delimiters into new URL structure.

Choose URI-component context, paste the exact encoded value, decode once and save the context with the result.

Literal plus remains plus and percent triplets decode exactly once.

Developer inspecting an HTML form field

Apply the form-urlencoded plus-as-space rule only when that media-type context is known.

Select form field context, compare `+` with `%2B`, and retain the explicit mode in the warning record.

Spaces and literal plus signs remain distinguishable.

Security and accessibility reviewer

Prevent decoded delimiters, markup, controls or redirect text from being executed or trusted.

Use named context/input/output controls, inspect malformed percent errors and treat output as inert text.

No navigation, markup rendering, double decoding or safety approval occurs.

Authoritative checks for this tool

Outputs and checklists are planning aids. Review the linked current authorities and the records, terms, instructions, and requirements that apply to your exact situation before a consequential decision.

Was this tool helpful?

Projects using URL Decoder

This tool is part of these guided projects. Each project provides step-by-step instructions with checklists and all the tools you need in one place.

Web App Security Review Record

Coordinate one authorized web-app security review from people, assets and threat boundaries through selected requirements, control evidence, safe testing, remediation, recovery, monitoring, and named risk acceptance.

6 steps13 toolsStart project

Related Tools

Tools you might need next

URL Encoder

Percent-encode one Unicode URI component with encodeURIComponent semantics, explicit context limits, and malformed UTF-16 rejection.

Recommended next stepEncoding
Base64 Decoder

Strictly decode standard or URL-safe Base64 into UTF-8 text, with explicit malformed-input errors and an untrusted-output security boundary.

Recommended next stepEncoding
JWT Decoder

Parse a JWT locally to inspect its segments and claims. Decoding alone does not verify signature, issuer, audience, expiry, authorization, or trust.

Recommended next stepWeb

Reference & details

How it works

Explicit plus semantics

URI-component mode passes plus through unchanged. Form-urlencoded field mode first converts plus to space, while `%2B` still decodes to a literal plus.

Strict one-pass decode

decodeURIComponent performs one percent-decoding pass and rejects malformed escapes or UTF-8. The Tool does not normalize, navigate, reparse, or decode the result again.

Untrusted text boundary

Decoded characters are placed in a read-only text control. Markup, delimiters and control-like output are not rendered, executed, opened, authenticated, or authorized.

Updated: August 2026

Example Scenarios

A developer decodes `a+b%2Bc` in both modes, recording `a+b+c` for URI-component context and `a b+c` for form-field context.

After the application separates URL structure, a reviewer decodes one encoded value exactly once and checks it against receiver-side validation.

A security reviewer confirms invalid escapes fail and markup-like decoded text stays inert rather than becoming navigation or rendered content.

FAQ

A literal plus remains plus in a generic URI component, while form-urlencoded parsing maps plus to space. The Tool never guesses between these incompatible meanings.

No. Parse and separate the scheme, authority, path, query, fragment, and subcomponents first. Decoding reserved delimiters too early can change how later code interprets structure.

No. It performs exactly one decode. Repeated decoding can turn a literal percent sequence into a delimiter or otherwise change meaning and is explicitly outside this workflow.

Incomplete escapes, non-hex triplets, and byte sequences that are not valid UTF-8 produce an explicit error instead of a partially decoded or replacement-character result.

No. The result may contain delimiters, controls, markup, script-like text, credentials, or redirect data. It is displayed only as inert text and needs context-specific validation.

About URL Decoder

Decode exactly once after choosing URI-component or application/x-www-form-urlencoded field context. Split complete URLs before decoding and treat every result as untrusted text.