When to use this
Decode when reading logs, redirect chains, OAuth callback parameters, or nested “url=https%3A%2F%2F…” values.
This page is a focused view of theURL Encode / Decode, which has the full set of options.
URL decode
Decoding collapses every three-character %XX escape back to its byte and reads the result as UTF-8: q%3Dblack%20%26%20white becomes q=black & white, and multi-byte sequences like %C3%A9 become their real character (é). The operation is decodeURIComponent — the same function every browser uses.
Double encoding has an exact signature: %25 is the escape for the percent sign itself, so a value that was encoded twice shows %253A where a colon should be — decode once to get %3A, twice to get “:”. Whenever a decoded URL still contains %XX sequences, count the %25 prefixes: each one is one extra layer of encoding applied somewhere in the pipeline.
When it goes wrong
“Could not decode this string.” means a % is not followed by two hex digits — a literal percent sign that should have been %25, or an escape truncated mid-sequence. Trim the string to the offending % (they are easy to spot) or encode stray percent signs first. If + signs appear where spaces belong, the input came from form data: replace + with spaces before decoding.
Next steps
Frequently asked questions
Why does decoding throw an error on my string?
A % not followed by two hex digits — a literal percent sign, or a truncated sequence — is invalid. Encode literal percent signs as %25.
What is double encoding?
Encoding an already-encoded string: %3A becomes %253A because the % itself gets encoded. It usually means two layers of software each encoded the value; decode twice to recover the original.
Should + become a space when decoding?
Only in form-encoded query strings. This tool follows decodeURIComponent semantics, where + is a literal plus — replace + with spaces first if your input came from form data.