What is the url decoder?
The URL Decoder turns percent-encoded text back into plain, readable characters, and when you paste a full link it breaks it into protocol, host, port, path, decoded query parameters and hash. Free and 100% in-browser, the decoding happens in your tab and nothing is uploaded.
Web addresses can only carry a limited set of ASCII characters, so anything else (spaces, accents, emoji, ampersands, slashes inside a value) gets 'percent-encoded' into sequences like %20, %C3%A9 or %26. That keeps links transportable but makes them unreadable to humans and easy to copy wrong. This URL Decoder reverses that encoding: paste any percent-encoded string and it decodes back to the original UTF-8 text as you type. When what you paste is a complete URL, it goes further and parses the link with the browser's native URL engine, laying out the protocol, host, port, path, fragment and, most usefully, every query parameter as its own decoded key/value row, so a tangled ?utm_source%3Dnewsletter%26q%3Dblack%2Bcoffee becomes a clean table you can actually read. You choose whether to decode as a component (decodeURIComponent, which unescapes reserved characters like & = ? /) or as a whole URI (decodeURI, which preserves structure), the two behave differently and picking wrong is a classic source of mangled output. Everything runs locally in JavaScript: there is no server round-trip, no logging and no account, so you can safely decode links that contain tokens, tracking IDs or private query values without them ever leaving your device.
- Difficulty:
- Easy
- Typical time:
- ~15s
- Processing:
- 100% browser processing
Last updated
How to use the url decoder
- 1
Paste your encoded text or URL
Drop a percent-encoded string or a whole link into the input. Paste it, drag a.txt file onto the pane, or load the sample to see how it works. Decoding starts instantly.
- 2
Read the decoded output
The plain-text result appears immediately. If a value contained %20, %26 or UTF-8 sequences like %C3%A9, you'll see the real spaces, ampersands and accented characters restored.
- 3
Explore the URL component table
If your input is a valid URL, a table breaks it into protocol, host, port, path and hash, plus one decoded row per query parameter, copy any single piece with a click.
- 4
Pick the right decode mode
Use component mode for a single pasted value, or whole-URI mode when you want to preserve a full link's structure. The tool explains the difference so you don't mangle the result.
- 5
Copy or share
Copy the decoded text or any component, or generate a share link that reopens the exact URL you're inspecting, the link travels in the URL fragment, so it stays local.
What URL Decoder includes
Live decoding as you type
There's no decode button. Paste or type a percent-encoded string and the plain-text result appears instantly, with each keystroke re-decoded so you can experiment and see the effect in real time.
Full URL component table
When your input is a real URL, it's parsed with the browser's native URL API into a labelled table: protocol, host, hostname, port, path, origin and hash: each copyable on its own.
Per-parameter query breakdown
The query string is split into individual key/value rows with both the raw and decoded value shown, repeats preserved, so a wall of &-joined tracking params becomes something you can actually read.
Component vs. whole-URI mode
Switch between decodeURIComponent (unescapes reserved characters like & = ? /) and decodeURI (preserves URL structure), the right choice for pasted values versus whole links, explained inline.
100% in your browser
Decoding and parsing run entirely client-side. Links containing tokens, session IDs or private query values are never transmitted, stored or logged, safe to decode real production URLs.
Copy, share & import
Copy the decoded text or any single component, share a deep link that reopens the exact URL you're inspecting, or drag a .txt file of links straight onto the input.
Why use our url decoder
Read encoded links at a glance
Stop mentally translating %20 and %C3%A9. Turn an unreadable, percent-riddled address back into the plain text it stands for so you can see what a link actually points to.
Audit tracking & UTM parameters
The query table makes every utm_source, utm_campaign and redirect target its own decoded row, so you can verify exactly what an analytics or ad link is carrying before you ship it.
Safe for private URLs
Because nothing is uploaded, you can decode links that embed access tokens, signed-URL signatures or personal query values without leaking them to a third-party server.
No sign-up, no limits
It's a single web page, decode as many URLs as you like on any device, with no daily cap, no watermark and no account wall between you and the answer.
Built for the way you work
From quick one-off fixes to daily workflows, see how people put this tool to use.
- Backend & API developers
Debug callback and redirect URLs
Decode an OAuth redirect_uri or webhook callback to see the real path and query it encodes, and confirm a double-encoded parameter isn't breaking your router before you blame the client.
- Marketers & growth teams
Verify UTM & campaign links
Paste a tracking link and read every utm_* parameter as its own decoded row, so you can confirm the source, medium and campaign are spelled exactly right before a send goes out.
- QA & support engineers
Reproduce bugs from raw URLs
When a bug report includes an unreadable encoded link, decode it to recover the exact page and parameters the user hit, turning a copy-pasted mess into a reproducible test case.
- Security researchers
Inspect suspicious links locally
Decode a possibly-malicious percent-encoded URL to reveal its true destination and payload parameters without visiting it, and without sending the link to any remote service.
Supported formats
Accepts URL, Percent-encoded text, Query string and .txt, and produces Plain text, Parsed components and Key/value table, all processed locally in your browser.
- URL
- Percent-encoded text
- Query string
- .txt
- Plain text
- Parsed components
- Key/value table
Frequently asked questions
Recommended tools
Base64 Encoder
Encode text or any file to Base64 instantly: Unicode-safe, with a URL-safe toggle and one-click data URLs. Runs entirely in your browser, nothing uploaded.
JSON Formatter
Format, validate and minify JSON in your browser with pinpoint error line + column, jump-to-error, key sorting and live editing: nothing is uploaded.
JWT Decoder
Decode and inspect any JSON Web Token instantly. Read the header, payload and signature, see when it was issued and expires, and optionally verify an HS256 signature. 100% in-browser. Your token never leaves your device.
UUID Generator
Generate secure UUIDs instantly, random v4, time-ordered v7, or the nil UUID. Bulk-generate up to 1,000, copy or export as TXT/CSV, all in your browser.
Barcode Generator
Generate scannable 1D barcodes (CODE128, EAN-13, UPC-A, CODE39, ITF-14, MSI, pharmacode and Codabar) live in your browser, with per-format validation and PNG or SVG export. Nothing is uploaded.
Base64 Decoder
Decode Base64 back to text or a file instantly: Unicode-safe, auto-detects URL-safe input, sniffs binary data and offers a download. Runs fully in your browser, nothing uploaded.
Common problems, solved
Hit a snag? Here are quick fixes for the issues people run into most.
'Input contains an invalid percent-encoding' error.
A lone % that isn't followed by two hex digits (like a literal 50% in text) breaks decoding. Encode the stray percent as %25, or remove it, then decode again. This also happens if part of a %XX pair was lost when copying.
No component table appears for my link.
The table needs a valid absolute URL. A relative path or a query string on its own has no scheme or host to parse. Prefix it with the scheme and host (e.g. https://example.com) and the breakdown will appear.
The decoded value merged my query into the path.
You likely decoded a whole URL in component mode, which unescapes the reserved ? & = / characters that hold a link together. Switch to whole-URI mode to decode a complete link while preserving its structure.
Accented or emoji characters come out as garbled symbols.
That's a sign the original bytes weren't valid UTF-8 or were partially copied. Re-copy the whole encoded string in one piece. The decoder handles UTF-8 percent sequences correctly when they're complete.
Get the most out of it
If decoded output still has % sequences, the input was probably double-encoded, decode it again to peel off the second layer.
Use component mode for a single value copied out of a query string, and whole-URI mode when you want to keep a full link's structure intact.
The component table only appears for absolute URLs. Add https:// to a bare path to unlock the full breakdown.
Use the share link to hand a teammate the exact URL you're inspecting. It travels in the page fragment, so it never touches a server.
Reading a tracking link? Scan the query table top-to-bottom to confirm each utm_* value is spelled correctly before the campaign goes live.
What's new
Recent updates and improvements to the url decoder.
Initial release: live percent-decoding, native URL parsing into a protocol/host/port/path/hash component table, and a decoded per-parameter query breakdown.
Added a component vs. whole-URI decode toggle with inline guidance, per-component copy buttons, and drag-and-drop / paste import of .txt files.
Introduced shareable deep links that carry the URL in the page fragment, a sample-link empty state, and keyboard shortcuts with an in-app reference.
Keep exploring
Problems we solve
Definitions
From the blog
- URL Encoding Explained: When and Why to Percent-Encode
- How to Find Exposed API Keys in Your Code (Before Someone Else Does)
- No AI Inside: How Our Regex Generator Actually Works
- How to Generate TypeScript Types from JSON (API Responses Made Type-Safe)
- Regex Cheat Sheet: Common Patterns and How to Test Them
Explore categories
Common tasks
Your privacy is built in
Your URL and everything in it (paths, tokens, tracking IDs and query values) are decoded and parsed entirely in your browser with JavaScript and the native URL API. Nothing is uploaded, stored, or logged on our servers, which is precisely why it's safe to decode real, private links here. Treat any URL that embeds a credential as sensitive and clear it when you're done.
- Runs in your browser
- No uploads
- Nothing stored
Ready to try the url decoder?
Free, private and instant. URL Decoder runs right in your browser.