How to Decode URL-Encoded Query Strings

DevOkk’s URL Decoder does the transform in the browser. That is the right default when the query contains an email, a token, or a path you would not paste into Slack.

Percent-encoding in one sitting

URLs are ASCII with a reserved set. Anything that is data but looks like syntax has to be escaped. The escape is % plus two hex digits for a byte. → %20. / → %2F. & → %26. = → %3D. Non-ASCII is UTF-8 first, then each byte is percent-encoded: é → %C3%A9.

Encoding is not optional if the value contains &. An unencoded q=one&two is two parameters, not one value. That is how filters silently drop half a search.

Decoding is the reverse: %HH → byte, then UTF-8 → string. You will also meet + as space in form encoding. That rule is older than the modern URL spec and it still bites.

This is a transport convention. It is not access control. email=a%40b.com is still an email address.

Query strings versus the rest of the URL

Path. /files/My%20Doc.pdf - decode to read the filename. + here is usually a plus, not a space.

Query. ?redirect=https%3A%2F%2Fexample.com%2Fapp - decode to see the target. This is the open-redirect checklist item: after decode, does it still stay on your origin?

Fragment. After #. Some apps stash UI state here. It is not sent to the server in a normal request, but it still lives in the browser and in screenshots.

Form bodies. application/x-www-form-urlencoded uses the same percent rules and treats + as space. If you copied from a POST body in the network panel, use those rules, not “path” rules.

JWT segments and Base64url are a different alphabet (- and _). If the value looks like eyJhbGciOi…, decode the query wrapper first, then take the token to JWT Decoder. Do not run the whole URL through a Base64 tool.

A debugging pass that stays local

1. Copy the query string or the full URL from the address bar or the network panel. Keep the original in a scratch line so you can compare.
2. Open URL Decoder. Paste. Read the plain text.
3. Split mentally on &. Each key=value should make sense. If you see value containing an extra &, something was not encoded on the way out.
4. If you still see %25, you are looking at double encoding. Decode again once. If you now have % leftover that should be literal data, stop. Over-decoding will eat real percent signs.
5. If the value is HTML (<div>), that is entities, not URL encoding. Switch to HTML Encoder in decode mode.
6. If the value is Base64, switch to Base64 Encoder.

Do this in the tab when the URL includes a recovery token, a signed callback, or a customer id. Access logs already have a copy. A random “URL decode online” site does not need another.

Plus signs, UTF-8, and the usual breakage

+ versus %20. HTML forms send spaces as +. Modern encodeURIComponent in JavaScript sends %20. If you decode a form body with a function that leaves + alone, you will see pluses in names and sentences. If you decode a JWT-in-query with a function that turns + into space, you will corrupt the token. Match the sender.

UTF-8. Almost everything on the web is UTF-8. If decoded text is mojibake, the sender used a different encoding (legacy Windows code pages still appear in old enterprise apps). The decoder is not “broken”; the bytes were never UTF-8.

Reserved characters in values. redirect_uri values must encode :, /, ?, and #. If they do not, the rest of the query is ambiguous. Fix the encoder on the producer, not the decoder on your desk.

Case of hex. %2f and %2F are the same byte. Compare decoded strings, not the encoded spelling.

Length. Some browsers and servers cap URLs. A query that contains a whole Base64 file is a design smell. Decode it so you can see the smell, then stop putting files in GET.

Encoding is not hiding, and it is not HTML safety

A token in a query string is visible to every proxy, the Referer header on the next navigation, browser history, and often analytics. Percent-encoding will not save you. Move secrets to a header or a POST body, and use short-lived values.

Decoded query values are also not safe to drop into HTML. q=<script> encoded as q=%3Cscript%3E becomes a script again after decode. Escaping for a URL and escaping for HTML are different jobs. If you are about to echo a parameter into a page, read How to Encode HTML Entities and then use your framework’s escaping, not a one-off paste.

Decode the ugly URL, then fix the encoder

Paste the ugly URL into URL Decoder, read the parameters, and fix the encoder that produced a broken split. If the next string is markup, use HTML Encoder. If it is Base64 or a JWT, use those tools instead of forcing percent-encoding to do every job.

Keep the original encoded URL until you have confirmed the decoded form. One extra decode is a common way to destroy a signature that contained a literal %.