URL Decode - Complete Guide

URL decoding reverses percent-encoding, converting %XX sequences back to their original characters. This is necessary when processing URLs from logs, extracting parameters from request URLs, or displaying human-readable versions of encoded URLs.

How It Works

The decoder finds %XX patterns (where XX is a hexadecimal byte value), converts them to bytes, and interprets the byte sequence as UTF-8 text. Plus signs (+) in query strings are converted to spaces. Invalid sequences should be handled gracefully or reported as errors.

Technical Details

Decoding converts %XX hexadecimal pairs to bytes, then interprets as UTF-8. Multi-byte UTF-8 characters produce sequences like %E2%82%AC (€). The + to space conversion is specific to application/x-www-form-urlencoded format (query strings). Path segments only use %XX encoding, never +.

Common Use Cases

1. Log Analysis: Decode URLs in web server logs for readability.
   • Example: /search?q=hello%20world becomes /search?q=hello world
2. Query Parameter Extraction: Decode parameter values from URL query strings.
3. URL Display: Show human-readable URLs in user interfaces.
4. Debugging: Decode URLs when debugging API requests.

Code Examples

JavaScript

// Decode URI component
const decoded = decodeURIComponent('hello%20world');
// Result: "hello world"

// Handle + as space (query string convention)
function decodeQueryValue(str) {
  return decodeURIComponent(str.replace(/\+/g, ' '));
}

// Parse entire query string
const params = new URLSearchParams('name=John+Doe&city=S%C3%A3o+Paulo');
params.get('city'); // "São Paulo"

// Handle malformed encoding gracefully
function safeDecode(str) {
  try {
    return decodeURIComponent(str.replace(/\+/g, ' '));
  } catch (e) {
    return str; // Return original if invalid
  }
}

URLSearchParams handles decoding automatically. For manual decoding, handle + to space conversion and malformed sequences.

Python

from urllib.parse import unquote, unquote_plus, parse_qs

# Decode URL component
decoded = unquote('hello%20world')  # "hello world"

# Decode with + as space (form data)
decoded = unquote_plus('hello+world')  # "hello world"

# Parse entire query string
params = parse_qs('name=John+Doe&city=S%C3%A3o+Paulo')
# {'name': ['John Doe'], 'city': ['São Paulo']}

unquote_plus handles + as space, unquote treats + as literal. parse_qs decodes entire query strings.

Tips & Best Practices

• Use URLSearchParams/parse_qs for full query string parsing
• Remember + only means space in query strings, not URL paths
• Handle malformed encoding gracefully in production code
• Decode UTF-8 sequences correctly for international characters
• Don't decode URLs multiple times (can corrupt valid %25 sequences)

Common Mistakes to Avoid

• Not handling + to space conversion for query parameters
• Multiple decoding passes (corrupts legitimate % characters)
• Using decodeURI for parameter values (use decodeURIComponent)
• Crashing on malformed % sequences instead of handling gracefully

When to Use This Tool

Use URL decoding when processing URLs from external sources: parsing query parameters, analyzing logs, displaying URLs to users. Essential for any URL manipulation in web applications.

Frequently Asked Questions

Why do I see %20 instead of spaces in my URLs?

Spaces aren't allowed in URLs. They must be encoded as %20 or + (in query strings). This is correct behavior. Browsers display the decoded version in the address bar for readability but transmit the encoded version.

What's the difference between decodeURI and decodeURIComponent?

decodeURI doesn't decode characters with special URL meaning (:/?#[]@!$&'()*+,;=). decodeURIComponent decodes everything. Use decodeURIComponent for parameter values, decodeURI only for complete URLs that should stay valid.

How do I handle malformed percent encoding?

Malformed sequences like %ZZ or truncated %2 should either pass through unchanged or raise an error. Use try/catch with decodeURIComponent - it throws URIError for invalid sequences. Consider decodeURIComponent(value.replace(/%(?![0-9A-Fa-f]{2})/g, "%25")).

Should I decode + as space?

In query strings (form data), yes - + represents space. In URL paths, + is a literal plus sign. JavaScript's decodeURIComponent doesn't convert +, so for query strings: decodeURIComponent(str.replace(/+/g, " "))

Get Started

Ready to try URL Decode? Use the tool now - it's free, fast, and works right in your browser.

---

Last updated: June 27, 2026