What does URL decoding do?

It reverses percent-encoding: %20 becomes a space, %26 becomes &, and multi-byte sequences like %E2%9C%93 become the Unicode character they represent (✓). It makes encoded links and query strings readable.

Should + be decoded as a space?

In query strings submitted by HTML forms, yes — + means space. In paths and in most other contexts a + is a literal plus sign. The option is on by default because most encoded text people paste comes from query strings; turn it off if your data contains real plus signs.

What happens with malformed input?

The decoder never fails. A lone % or a sequence like %ZZ is left exactly as it is, bytes that do not form valid UTF-8 are kept encoded, and a warning explains that part of the input could not be decoded.

What is double encoding?

When already-encoded text is encoded again, % becomes %25 — so a space ends up as %2520. The decoder detects this and shows each layer, so you can see what the original text was.

Is my input sent anywhere?

No. Decoding runs locally in your browser. Nothing is sent to Zurl or anyone else.

URL ParametersRuns in your browser

URL Decoder

Turn percent-encoded URLs and query strings back into readable text. Handles form-style + spaces, double encoding and malformed sequences — entirely in your browser.

Encoded text or URL0 characters

Treat + as a space (form / query-string encoding)

Decoded output0 characters

Runs entirely in your browser. Nothing you enter is sent to Zurl.

How to use the URL Decoder

Step 1: Paste the percent-encoded text or URL.
Step 2: Choose whether + means a space.
Step 3: Copy the decoded result.

Where encoded URLs come from

Tracking links in emails, redirect URLs embedded as a parameter (?next=https%3A%2F%2F…), search result links and server logs are all full of percent-encoding. Decoding them shows what the link really contains — often another complete URL hidden inside a parameter.

Reading a decoded URL

Paste a full URL and the decoder also lists each query parameter with its decoded value. If one of those values is itself a URL, that is where the link ultimately sends people. For a deeper look at the parameters, the UTM parser separates campaign tags from everything else, and the parameter remover lets you strip the ones you do not need.

Decoding in code

JavaScript’s decodeURIComponent() throws on malformed input, so wrap it in try/catch. new URLSearchParams(query).get(name) decodes a parameter value and treats + as a space. In Python, urllib.parse.unquote() (or unquote_plus() for form data).

Frequently asked questions

What does URL decoding do?: It reverses percent-encoding: %20 becomes a space, %26 becomes &, and multi-byte sequences like %E2%9C%93 become the Unicode character they represent (✓). It makes encoded links and query strings readable.
Should + be decoded as a space?: In query strings submitted by HTML forms, yes — + means space. In paths and in most other contexts a + is a literal plus sign. The option is on by default because most encoded text people paste comes from query strings; turn it off if your data contains real plus signs.
What happens with malformed input?: The decoder never fails. A lone % or a sequence like %ZZ is left exactly as it is, bytes that do not form valid UTF-8 are kept encoded, and a warning explains that part of the input could not be decoded.
What is double encoding?: When already-encoded text is encoded again, % becomes %25 — so a space ends up as %2520. The decoder detects this and shows each layer, so you can see what the original text was.
Is my input sent anywhere?: No. Decoding runs locally in your browser. Nothing is sent to Zurl or anyone else.