01
Strict percent checks
Reject a percent sign that is not followed by exactly two hexadecimal digits.
Start typing to search 227 tools.
Encode & Decode
Ready
URL Decoder
Decode valid percent-encoded UTF-8 text while preserving literal plus signs for accurate URL-component inspection.
Strict percent-sequence check UTF-8 output validation Literal plus preservation Single-pass component decoding
Private browser processing. Your input is processed on this device and is not sent to the Trexmi server.
INPUT Percent-encoded component *
Paste the source value for this specific transformation. Example: docs%2FAPI%20v2%3Fdraft%3Dtrue
Decoded text
Decoded text ready to review and copy.
About the tool
What URL Decoder does
URL Decoder converts valid %HH byte sequences into readable UTF-8 text. It rejects incomplete or non-hexadecimal percent escapes and reports data that does not decode to valid UTF-8.
The decoder uses component-style behavior comparable to decodeURIComponent(). A literal plus sign remains +; it is not changed to a space. This differs from traditional form-query decoding, where plus is often interpreted as a space.
Decode only the intended layer. A second decoding pass can turn previously protected separators into active URL syntax, changing the meaning of a redirect, path, or query value.
How to use
- Isolate the encoded value. Select the query value, path segment, or other component rather than an unrelated complete URL.
- Paste the exact source. Keep every percent sign and hexadecimal pair.
- Run the decoder. Invalid percent escapes or invalid UTF-8 are rejected.
- Compare the result. Check spaces, slashes, question marks, ampersands, plus signs, and Unicode carefully.
- Validate before use. Treat the decoded value as untrusted input in the receiving application.
Built for the task
Why use URL Decoder?
Focused controls, predictable output, and a workflow designed around this exact transformation.
02
Valid UTF-8 output
Report decoded byte sequences that cannot be interpreted as UTF-8 text.
03
Plus signs preserved
Keep literal plus signs unchanged instead of applying form-query space conversion.
04
Repeated-decoding warning
The guide explains how additional decoding passes can activate hidden separators.
Useful answers
Questions about URL Decoder
Practical details about input, output, privacy, limits, and the best way to use this tool.
01 What does URL Decoder decode?
It decodes valid percent-encoded bytes and requires the resulting text to be valid UTF-8.
02 Does plus become a space?
No. Literal plus signs remain plus. Use a query-string parser when form-style plus-to-space handling is required.
03 What happens to ?
It decodes to a space character.
04 Why is %2 rejected?
Every percent escape must contain two hexadecimal digits, so the sequence is incomplete.
05 Can I decode an entire URL?
You can, but decoding structural separators may change how the URL is interpreted. Component-level decoding is safer for inspection.
06 What is repeated decoding?
It means decoding the output again. For example, %252F becomes %2F first and a slash only on the second pass.
07 Is decoded content safe to trust?
No. Validate redirects, paths, identifiers, and other decoded values according to application rules.
08 Does URL decoding decrypt data?
No. Percent encoding is a reversible text representation, not encryption.
Learn URL Encoding
Read the complete URL Encoding Guide
Learn percent-encoding, UTF-8 URLs, query strings, path segments, spaces, plus signs, and double-encoding mistakes.
- Percent-encoding rules
- Query strings and paths
- UTF-8 and double encoding
Read guide
Practical explanations and examples
Percent sequences and UTF-8 text
A percent escape contains % followed by two hexadecimal digits representing one byte. ASCII characters commonly use one byte, while Ukrainian text, emoji, and many other Unicode characters require multiple UTF-8 bytes and therefore several adjacent escapes.
The decoder validates the final byte sequence as UTF-8. If the original source used another character encoding, technically valid bytes may not produce the expected text.
Literal plus signs and query-form decoding
Component decoding and HTML form-query decoding treat plus signs differently. This tool preserves + as a literal plus. A percent-encoded %2B also becomes plus, while %20 becomes space.
If the source is a complete query string such as q=blue+shoes, use Query String Parser to apply form-style parameter rules and inspect repeated names.
Decode exactly the intended layer
Nested URLs and redirects may be encoded more than once. Decode one layer, inspect the result, and stop unless the protocol explicitly requires another pass. Blind repeated decoding can turn protected slashes, ampersands, or path traversal sequences into active syntax.
Signed URLs are especially sensitive because changing the byte representation may invalidate the signature. Preserve the original value for comparison.
Invalid percent sequences and unexpected output
A bare percent sign, a one-digit escape, or non-hexadecimal characters after percent are rejected. When output looks corrupted despite valid escapes, verify the original character encoding and whether the input was already decoded earlier in the pipeline.
Do not repair malformed security-sensitive values by guessing missing characters. Return a clear validation error to the caller instead.
Treat decoded values as untrusted input
Decoding can reveal separators, scripts, control data, or redirect destinations that were hidden in the encoded form. Apply path normalization, allowlists, output escaping, authorization, and domain-specific validation after decoding at the appropriate boundary.
Related Trexmi tools
Create a component value with URL Encoder, parse full parameters with Query String Parser, or inspect a complete address using URL Parser.
Technical references
See RFC 3986 for URI syntax and the MDN documentation for decodeURIComponent().