URL Decoder - Decode Percent-Encoded URLs Online Free

What Is URL Decoding?

URL decoding is the reverse process of URL encoding. It converts percent-encoded sequences like %20, %26, and %3D back to their original characters — spaces, ampersands, equals signs, and everything else that was encoded for safe transmission over the internet. When a URL or query string contains percent-encoded characters, decoding restores the original human-readable text.

Every percent-encoded character follows the same pattern: a percent sign (%) followed by two hexadecimal digits that represent the character's ASCII code. For example, the space character has an ASCII value of 32 (hexadecimal 20), so it is encoded as %20. The ampersand has an ASCII value of 38 (hexadecimal 26), so it becomes %26. URL decoding simply reverses this mapping, converting each %XX sequence back to the character it represents.

PHP provides two functions for decoding: urldecode(), which handles application/x-www-form-urlencoded data (where spaces may appear as + signs), and rawurldecode(), which handles URLs encoded per RFC 3986 (where spaces are %20). Both functions correctly decode the vast majority of percent-encoded strings you will encounter.

Why Is URL Decoding Important?

URLs on the web are encoded to ensure they can be transmitted reliably across different systems, protocols, and networks. But encoded URLs are not human-readable. Decoding is essential whenever you need to understand, display, or process the actual content of an encoded URL.

• Readability — Encoded URLs are difficult to read. A URL like ?q=hello%20world&lang=en is much clearer once decoded to ?q=hello world&lang=en.
• Debugging — When something goes wrong with a URL, decoding reveals the actual parameter values so you can identify issues like double-encoding, truncation, or incorrect character replacement.
• Data extraction — APIs, webhooks, and server logs often contain encoded URLs. Decoding is necessary to extract meaningful data from query parameters, redirect URLs, and callback endpoints.
• Security inspection — Malicious actors sometimes use URL encoding to disguise harmful payloads. Decoding suspicious URLs before clicking or processing them is a basic security practice.

When Should You Decode a URL?

There are several common scenarios where URL decoding is necessary or helpful:

• Reading API responses — REST APIs frequently return encoded URLs in their responses. Decoding them makes endpoint paths, query parameters, and resource identifiers readable for debugging and documentation.
• Debugging URL parameters — When a web application misbehaves, decoding the URL reveals exactly what data is being passed between pages. This helps identify encoding bugs, missing parameters, or malformed values.
• Extracting query parameters — When parsing a URL to read specific parameter values, those values will be percent-encoded. Decoding is required to get the actual user input, search terms, or filter values.
• Displaying URLs to users — Raw encoded URLs are confusing to end users. Decoding them for display in dashboards, reports, or documentation makes the content immediately understandable.
• Checking for double-encoding — If you see sequences like %2520 in a URL, it has been double-encoded (the % itself was encoded to %25). Decoding once converts %2520 to %20, and decoding a second time produces a space.
• Verifying redirect URLs — Before following a redirect, decoding the target URL lets you verify where it actually leads, which is important for security and debugging.

Common URL-Encoded Characters

Here are the most frequently encoded characters you will encounter when decoding URLs:

• %20 — Space character. The most common encoded character in URLs.
• %26 — Ampersand (&). Used as a query string separator, so it must be encoded inside parameter values.
• %3D — Equals sign (=). Separates parameter names from values, so it must be encoded inside values.
• %2F — Forward slash (/). Used as a path separator.
• %3F — Question mark (?). Marks the start of the query string.
• %23 — Hash symbol (#). Marks the fragment identifier.
• %3A — Colon (:). Used in scheme prefixes like http: and https:.
• %40 — At sign (@). Used in userinfo sections of URLs.
• %2B — Plus sign (+). In form-encoded data, a + represents a space.
• %25 — Percent sign (%). Encoded when the literal percent character appears in data.

URL Decoding vs URL Encoding

Encoding and decoding are two sides of the same coin:

• URL encoding converts unsafe or special characters into percent-encoded format for safe transmission. A space becomes %20, an ampersand becomes %26.
• URL decoding reverses this process, converting %20 back to a space, %26 back to an ampersand, and so on.

You can switch between encoding and decoding modes using this tool. If you need to encode a URL, visit our URL Encode tool instead.

Double-Encoding: A Common Problem

One of the most frequent issues developers encounter with URLs is double-encoding. This happens when an already-encoded URL is encoded a second time:

• Original text: hello world
• First encoding: hello%20world
• Double-encoded: hello%2520world (the % was encoded to %25)

If you see %25 sequences in a URL, the string has been double-encoded. Decoding it once converts %2520 to %20. Decoding it a second time converts %20 to a space. The best solution is to prevent double-encoding by only encoding once in your application code.

URL Decoding vs Base64 Decoding

These two decoding methods serve different purposes and should not be confused:

• URL decoding reverses percent-encoding (%20 to space). It is specific to URLs and query strings.
• Base64 decoding reverses base64 encoding, which converts binary data to ASCII text using a 64-character alphabet. It is used for embedding images in HTML, encoding JWT tokens, and transferring binary data over text-based protocols.

If you need to decode base64-encoded strings, use our Base64 Encode/Decode tool instead.

Use Cases in Web Development

• API debugging — When troubleshooting API calls, decoding the request and response URLs reveals the actual parameters being sent and received.
• Log analysis — Server logs contain encoded URLs. Decoding them makes it possible to analyze traffic patterns, search queries, and user behavior.
• Form processing — HTML forms with method="GET" encode data into the URL automatically. Server-side code decodes these values to process form submissions.
• OAuth and authentication — Authorization codes, access tokens, and callback URLs in OAuth flows are encoded. Decoding is necessary to inspect and debug authentication sequences.
• Content management systems — CMS platforms often store URLs in encoded format. Decoding is required before displaying them in the admin interface or frontend.
• Web scraping — Scraped URLs may be encoded. Decoding them reveals the actual page paths, search queries, and parameter values for analysis.

How to Use This Tool

1. Paste the encoded URL — Enter the percent-encoded URL, query string, or text into the input area.
2. Click Decode — The tool decodes all percent-encoded sequences back to their original characters using PHP's urldecode().
3. Copy or Download — Use the Copy button to copy the decoded result to your clipboard, or click Download as TXT to save it as a file.

Need to encode instead? The tool also supports URL Encode mode to convert special characters into percent-encoded format.

Related Tools

• URL Encode — Convert special characters to percent-encoded format for safe URL transmission.
• Base64 Encode/Decode — Encode and decode base64 strings for data transfer and authentication tokens.

Privacy and Security

URL decoding is performed entirely on our servers using PHP's native urldecode() function. We do not store your input or decoded output. The tool processes your data in memory and discards it immediately after returning the result. No cookies, tracking scripts, or analytics collect your decoded URLs.