A nested redirect target
Input
https%3A%2F%2Fex.com%2Fp%3Fq%3Da%20b%26r%3D1%23top
Result
https://ex.com/p?q=a b&r=1#top
The whole URL was one parameter value. Once decoded it is obvious which query the callback was carrying.
Encoding Tools
URL Decoder
Decode escaped URLs and inspect the original path or query string.
Decoded output
https://softkey-tools.local/search?q=angular tools&mode=phase 1
Understand the format
How URL Decoder works
Decoding turns percent-escapes back into the characters they represent, which is how you read what a redirect, callback, or tracking parameter actually contained.
Reading escaped values in context
Percent-decoding reverses the escaping: each %XX sequence becomes the byte with that hexadecimal value, and the resulting byte sequence is interpreted as UTF-8. A single non-ASCII character often appears as two or three consecutive escapes, so %C3%A9 is one character, é, rather than two.
Decoding is the fastest way to understand an opaque URL. Authentication callbacks, payment returns, and marketing links routinely nest a complete URL inside a parameter, and reading it plainly usually explains at once why the user was sent to the wrong place.
When a value needs decoding twice
If the decoded output still contains percent escapes, the value was encoded more than once. That happens when each layer of a system encodes a parameter that was already encoded by the layer before it. Decoding repeatedly is fine for diagnosis, but the real fix is to remove the extra encoding step in the pipeline.
Note that the reverse case, a value that fails to decode, is also informative. A stray % that is not followed by two hexadecimal digits is a malformed URI, which is usually the result of concatenating strings by hand instead of encoding them properly.
Step by step
How to use URL Decoder
- Paste the encoded URL or the single parameter value you want to read.
- Read the decoded output, or the error banner if the escapes are malformed.
- If escapes remain in the output, decode again and note that the value was double-encoded.
- Compare the decoded destination against the redirect allowlist the application is supposed to enforce.
Decoding uses decodeURIComponent in the page. Callback URLs, internal hostnames, and query parameters are never transmitted or stored.
Worked examples
URL Decoder examples explained
A double-encoded value
Input
a%2520b
Result
a%20b, which decodes again to "a b"
The %25 is a literal percent sign, the fingerprint of a value that passed through two encoding steps.
Reference
Interpreting what you get back
| Symptom | Cause | Action |
|---|---|---|
| Output still contains %20 or %3A | The value was encoded twice. | Decode again, then remove the duplicate encoding step upstream. |
| URI malformed error | A stray % or an incomplete escape. | Check for hand-built strings and truncated copies. |
| Accented characters appear as é | The bytes were decoded as Latin-1 somewhere in the chain. | Ensure UTF-8 is used end to end. |
| Plus signs became spaces | The producer used form encoding. | Expected in form-encoded data; escape literal + as %2B. |
Practical Guide
How teams use URL Decoder
Common use cases
- Inspect nested redirect parameters in authentication and payment flows.
- Read human-friendly values out of copied browser addresses and log lines.
- Check whether a broken link failed because a value was encoded more than once.
Checks before trusting the result
- Decoding malformed input fails by design; confirm the source string is complete before assuming a bug.
- If the result still looks encoded, the source was encoded multiple times.
- Separate path problems from query problems when diagnosing a redirect.
Troubleshooting
Common mistakes and how to fix them
- Decoding a URL and then using it directly in an HTTP request.
- The decoded form may contain characters that break the request. Decode to read, re-encode to send.
- Assuming a decoded redirect target is safe to follow.
- Validate it against an allowlist. Unvalidated redirect parameters are the standard open-redirect vulnerability.
- Decoding an entire query string at once and losing the boundaries.
- Split on & and = first, then decode each name and value separately.
FAQ
URL Decoder questions, answered
Why does decoding fail with a URI malformed error?
A % must be followed by exactly two hexadecimal digits. A lone percent sign, a truncated escape, or an invalid UTF-8 byte sequence causes the decoder to stop.
How do I know a value was double-encoded?
Look for %25 in the source, or percent escapes that survive one round of decoding. Both mean an encoding step ran twice.
Does decoding convert + into a space?
Not here. Percent-decoding leaves + alone, because that convention belongs to form encoding rather than to URI syntax. Replace + with a space yourself when the source is a form-encoded body.
Is it safe to decode a link someone sent me?
Yes. Decoding is pure text processing in your browser and does not request the URL. Reading a suspicious link this way is safer than clicking it.
Why do some characters look wrong after decoding?
A charset mismatch. The escapes decode to UTF-8 bytes here; if the producer used a different encoding, accented characters and symbols come out garbled.
Go deeper
Specifications and guides
- Base64, Hex, and Percent-Encoding Compared — Three encodings, three jobs. How to tell them apart, when each is correct, and why none of them protects data.