Percent Encoding Decoder
Decode %XX percent-encoded URLs and strings, including multi-byte UTF-8. Paste an encoded value and read the plain text, or switch to encode mode.
Loading tool…
How It Works
Percent encoding writes a character that is unsafe in a URL as a percent sign followed by two hexadecimal digits, so a space becomes %20 and a slash inside a query value becomes %2F. A percent encoding decoder runs that transformation backwards, and this page opens the URL tool already switched to its decode direction.
What the decoder reads. The input is scanned for %XX triplets. Each one is a byte, and consecutive triplets belong to the same character when the character is not ASCII: %E4%BD%A0 is the three UTF-8 bytes of one Chinese character, not three characters. The decoder rebuilds that byte sequence and then applies the UTF-8 rules, which is why multi-byte text comes back as text rather than as three garbage symbols.
What happens on bad input. The browser's decodeURIComponent throws on anything it cannot resolve, and the page catches that and shows "Malformed URI component" instead of a half-decoded string. Two cases trigger it: a triplet that is not valid hexadecimal, such as %ZZ, and a truncated multi-byte sequence, such as %E4%BD, which stops two bytes into a three-byte character. A literal percent sign that is not part of an escape therefore needs to arrive as %25.
What it deliberately leaves alone. The plus sign is not converted to a space. RFC 3986 does not define + as anything special; the convention that + means space belongs to form submission and is applied when a server parses application/x-www-form-urlencoded data. Decoding a query string here keeps + as a plus, so a value that truly contained a space will show it as +, and you should decode that specific case with a form decoder.
Double encoding. Decoding runs once, so %2520 becomes %20 rather than a space. That is the correct behaviour: the value was encoded twice on the way in, and you need to paste the intermediate result again to get the final text.
Log lines, redirect targets, analytics parameters and API error messages are the usual places this page earns its keep: paste the encoded fragment and read what the server actually received.
How to decode an encoded value in four steps
- Paste the encoded string — the page opens in decode mode, but check the mode selector still says decode.
- Read the plain text. Multi-byte characters arrive as consecutive triplets, so there is no need to split them by hand.
- If the result still shows %20 sequences, decode it a second time: the value was encoded twice on the way in.
- Replace + with %20 before decoding only when the string came from an HTML form, where a plus means space.
Encoded values and what they become here
| Encoded input | Decoded output | Why it resolves this way |
|---|---|---|
| hello%20world | hello world | %20 is the escape for a space |
| %E4%BD%A0%E5%A5%BD | 你好 | Six triplets rebuild two three-byte UTF-8 characters |
| a+b | a+b | RFC 3986 does not define + as a space, so it passes through |
| %2520 | %20 | Decoding runs once; a double-encoded value returns its single-encoded form |
| %E4%BD | Malformed URI component | A truncated three-byte character is rejected, not half-decoded |
Examples
Input
hello%20worldOutput
hello worldThe space in a query value, which an encoder wrote as %20, comes back as a space.
Input
%E4%BD%A0%E5%A5%BDOutput
你好Six triplets rebuild two three-byte UTF-8 characters.
Input
%E4%BDOutput
Malformed URI componentBoundary case: a truncated three-byte character. The decoder refuses to emit broken text and returns an error instead.
Frequently Asked Questions
- Why is + still a plus instead of a space?
- Because this decoder follows RFC 3986, where + is an ordinary character. Only form encoding treats it as a space. If your value came from an HTML form or a URLSearchParams payload, replace + with a space yourself after decoding, or the text will look wrong wherever a space was encoded that way.
- Can it decode Chinese, Japanese and emoji?
- Yes. Multi-byte characters arrive as several consecutive %XX triplets, and the decoder reassembles the bytes before interpreting them as UTF-8. An emoji is four bytes, so it appears as four triplets. A truncated set of triplets is rejected rather than turned into replacement characters.
- What does Malformed URI component mean?
- It means the browser could not resolve part of the input as a valid escape. The usual causes are a non-hexadecimal triplet such as %ZZ, a truncated sequence such as %E4%BD, or a bare percent sign from text that was never encoded. Find the triplet the message points at and complete or remove it.
- Does it encode as well as decode?
- The page opens in decode mode, but the mode selector is still on the tool, so you can switch it to encode and percent-encode a string instead. Encoding covers the whole input, including slashes and colons, because the tool does not split a URL into protocol, host and path.
Limitations & Accuracy
Decoding follows RFC 3986, so a plus sign stays a plus and is never read as a space; form-encoded values need a form decoder or a manual replacement. Decoding happens once, so a double-encoded value returns its single-encoded form. Invalid or truncated escapes return Malformed URI component with no partial output, and the mode selector stays editable, so switching it to encode reverses the direction.