Free Tool
URL Decoder
A web address can hide its real meaning behind percent-encoding: %2F%2Fevil.example looks harmless until you decode it and read //evil.example. Paste an encoded address or piece of text below and this tool decodes it in your browser, so you can see what a link really says before you trust it.
Decode before you trust. Percent-encoding changes how a link looks, not where it goes. Decoding a suspicious address is one of the fastest ways to spot a phishing link — and this tool does it without visiting the address.
What this tool does
Percent-encoding writes characters that do not belong in a web address as a percent sign followed by two hexadecimal digits. A space becomes %20, a slash becomes %2F, and é becomes %C3%A9. It is a normal and necessary part of the web — every search term with a space in it travels encoded — but it also gives attackers a way to disguise a link. A domain that would look suspicious in plain text can look harmless when its slashes and dots are encoded, and a reader who does not decode it will not see the trick.
This decoder reverses the process. Paste an encoded address, a piece of encoded text, or a suspicious link, and it turns every percent-encoded triplet back into its character, in your browser. Invalid sequences — a percent sign not followed by two hexadecimal digits — produce a clear error instead of a guess, because a wrong decode is worse than no decode.
The decoder is the companion to the URL encoder on this site, and to the URL structure analyser, which breaks a whole address into its parts and flags the tricks that encoding can hide. Together they teach one habit: read a link by decoding it first, and never click an address you have not understood.
Try it
Paste percent-encoded text and decode it. Never paste a link here and then visit it — decode first, decide second.
Waiting. Press Decode the URL text.
How it works
Decoding scans the text for percent signs. When it finds one followed by two hexadecimal digits, it converts those digits back to a byte, and collects the bytes in order. When the scan is finished, it interprets the collected bytes as UTF-8 text — the same encoding the encoder used — so accented characters and emoji come back correctly. Characters that were never encoded pass through unchanged.
This page uses the browser's built-in decodeURIComponent function, which follows the same RFC 3986 rules as the encoder. It is strict about invalid input: a percent sign followed by something that is not two hexadecimal digits, or a byte sequence that is not valid UTF-8, makes it throw an error, which the page catches and reports plainly. That strictness matters, because a decoder that guesses at invalid input would produce text that looks decoded but is wrong.
A plus sign is left alone by this decoder, because in a URL a plus is a plus — it only means a space in form data, not in a general address. If you decode form data and a plus appears where a space should be, that is the difference between the two conventions, and the encoder page on this site explains it.
Limitations
Decoding shows you what the text says; it does not tell you whether the text is safe. A decoded phishing link is still a phishing link, and a decoded address that looks legitimate can still lead somewhere dangerous — for example, a lookalike domain that differs from the real one by one letter. Decoding is a step in reading a link, not a verdict on it.
- The decoder handles standard percent-encoding. It does not decode double-encoded text — text encoded twice, such as %252F — in one pass; run it again on the result if you suspect double encoding.
- Plus signs are not converted to spaces, because in a URL a plus is a plus. Form data uses a different convention.
- Nothing you paste is sent anywhere. The tool never visits the address you decode, and the computation is local.
Examples
Example 1 — hello%20world%20%26%20friends. Decoding gives hello world & friends. The spaces and the ampersand come back, and the text is readable again. This is the round trip of the encoder on this site.
Example 2 — the disguised link. Press Try a disguised link to decode a fragment that reads, encoded, as harmless punctuation — and, decoded, as //evil.example. The slashes were hidden behind %2F, and the domain was plain once decoded. That is the trick this tool exists to catch: encoding that hides where a link goes.
Example 3 — café. Decoding caf%C3%A9 gives café. The é is two bytes in UTF-8, written as two encoded triplets, and the decoder reassembles them into the single character. If you see %C3%A9 in an address, it is almost always an accented letter, not something suspicious — context is what decides.
Frequently asked questions
What is percent-decoding?
Reversing percent-encoding: turning a percent sign followed by two hexadecimal digits back into the byte it represents, then reading the bytes as text. %20 becomes a space, %C3%A9 becomes é.
Why do some links look encoded?
Because web addresses can only contain certain characters safely, so everything else is percent-encoded. Search terms, names and non-English text are routinely encoded — but encoding is also used to disguise a link, which is why decoding before trusting is a good habit.
What is double encoding?
Encoding an already-encoded text a second time, so %2F becomes %252F. It is sometimes used to slip a character past a filter. If a decode still looks encoded, decode it again.
Does decoding a link make it safe to click?
No. Decoding only shows you what the link says. A decoded phishing link is still a phishing link — check the domain, the context and the sender before you click anything.
Why does the decoder reject some input?
Because a percent sign must be followed by exactly two hexadecimal digits, and the resulting bytes must be valid UTF-8. Invalid input produces an error instead of a guess, because a wrong decode is worse than no decode.