Online URL Decoder

Reconstructing Human-Readable Strings from Percent-Encoded URLs

In modern web applications, search engine tracking systems, affiliate networks, and email campaign managers frequently pass complex URLs through layers of percent-encoding. When analyzing referral paths, debugging redirect loops, or inspecting tracking parameters in server logs, engineers encounter heavily encoded strings filled with sequences like %20, %2F, and %3F.

URL decoding reverses percent-encoding by translating hexadecimal byte representations back into their corresponding ASCII and multi-byte UTF-8 characters, restoring human-readable text.

The Two-Step Parsing Process of URL Decoding

When a web client or decoding utility evaluates a percent-encoded string, it carries out a multi-stage decoding process:

1. Token Scanning and Hexadecimal Conversion: The scanner scans the input string from left to right. When it encounters a percent sign (%), it captures the immediate two following characters, verifies that both characters are valid hexadecimal digits (0-9, A-F, or a-f), and translates that pair into an 8-bit byte.
2. Multi-Byte UTF-8 Reassembly: For standard US-ASCII characters (values between 0x00 and 0x7F), each decoded byte corresponds directly to a single character. For international characters, non-Latin scripts, and emojis, the UTF-8 specification requires multiple bytes (from 2 up to 4 bytes). The decoder must collect the sequence of byte fragments and reconstruct the complete Unicode code point.

Common Percent-Encoded Sequences

Security Considerations: Double-Encoding and Path Traversal

URL decoding plays an important role in application security. Security researchers and backend engineers must remain vigilant regarding how web servers handle encoded user inputs:

• Double-Encoding Vulnerabilities: If a web application decodes an input string, runs security filters, and then decodes the string a second time later in the execution pipeline, attackers can bypass security rules. For example, encoding ../ as %252E%252E%252F bypasses filters that check for ../ on the first decode, but resolves to a directory traversal path on the second decode.
• Open Redirect Exploits: Malicious links often hide untrusted redirect destinations inside deeply encoded parameter values (e.g., https://trusted.com/login?redirect=https%3A%2F%2Fmalicious.com). Decoding URLs locally before clicking allows security analysts and users to inspect the true final destination.
• Server-Side Request Forgery (SSRF): When APIs accept URLs as parameters to fetch remote resources, attackers may use encoded hostnames or IP addresses to probe internal cloud metadata services. Local decoding tools help engineers inspect and sanitize these inputs safely.

Handling Malformed Sequences and Decoding Failures

Standard JavaScript decodeURIComponent() will throw a URIError: URI malformed if it encounters a percent sign that is not followed by two valid hex characters or if a multi-byte UTF-8 sequence is incomplete. A resilient decoder catches these exceptions gracefully, provides clear feedback, and handles spaces represented as plus signs (+) commonly produced by legacy HTML form submissions.