🔓 URL Decoder

Turn %20, %C3%A0 and friends back into readable text. If you paste a whole URL, the query string is broken out parameter by parameter so you can actually read it.

Encoded text or URL

Decoded live as you type. + is treated as a space.

How the decoding works

Every + is turned into a space, then the whole string goes through decodeURIComponent, which reads each %XX as one byte and reassembles UTF-8 sequences into characters:

%20        -> space        1 byte
%C3%A9     -> e-acute      2 bytes
%E2%82%AC  -> euro sign    3 bytes
%F0%9F%98%80 -> emoji      4 bytes

If the text contains ? and starts with a scheme such as https://, a second card splits the query string: anything after # is dropped, the rest is cut on &, and each pair is split at its first = so a value containing another equals sign survives intact. Both the name and the value are decoded separately, which is why a nested URL in a redirect_uri becomes readable.

When it refuses, and why

A bare percent sign is an error. % must be followed by two hex digits, so 50% off fails - the encoded form is 50%25%20off.
Plus becomes space everywhere, not just in the query. That matches how form data is encoded, but it will damage a path or a base64 value that contains a real +.
Double encoding needs two passes. If the output still shows %20, paste it back in - the original was encoded twice.

Decoding is display only. A decoded value is not safe to drop into HTML or SQL; whatever the parameter meant, it is still untrusted input.

Frequently asked questions

What does %20 mean in a URL?

It is a space. URLs cannot contain literal spaces, so each one is sent as the hex value of its byte, 0x20, after a percent sign.

Why does one character turn into %C3%A9 or three percent codes?

Percent-encoding works on bytes, not letters. Text is converted to UTF-8 first, where accented Latin letters take two bytes, most symbols and CJK characters take three, and emoji take four - one %XX each.

What is the difference between + and %20?

Both decode to a space, but only in query strings and form bodies, where the older application/x-www-form-urlencoded rule applies. In a path, + is a literal plus, so %20 is the safer thing to send everywhere.