URL Decoder

What Is URL Decoding?

URL decoding (percent-decoding) is the reverse of URL encoding — it converts percent-encoded sequences like %20, %26, and %D9%85 back into their original characters (space, &, and م respectively). The Toolsiro URL Decoder decodes any percent-encoded URL or text string and also parses the decoded URL into its components — protocol, host, path, and individual query parameters — making it easy to inspect and debug URLs at a glance.

How URL Decoding Works

Each %XX sequence in a URL is a hexadecimal representation of one byte. For ASCII characters (code points 0–127), one byte is sufficient. For Unicode characters such as Arabic, Chinese, or accented Latin characters, multiple consecutive bytes are needed because they use multi-byte UTF-8 encoding:

• %20 → space (one byte, hex 0x20 = decimal 32)
• %2F → / (one byte, hex 0x2F = decimal 47)
• %D9%85 → م (two bytes: 0xD9 and 0x85 — the UTF-8 encoding of Arabic letter Meem)
• %E4%B8%AD → 中 (three bytes: the UTF-8 encoding of the Chinese character for "middle/China")

Common Uses for URL Decoding

• Reading encoded URLs from server logs: Web server access logs record raw percent-encoded URLs. Decoding them makes them human-readable — /search%3Fq%3D%D9%83%D8%AA%D8%A8 becomes /search?q=كتب.
• Debugging API requests: When an API call fails, copying the raw request URL into a decoder immediately reveals whether parameters were encoded correctly, whether special characters were double-encoded, or whether any values are malformed.
• Reading JWT tokens: JWT tokens are Base64url-encoded, but their query string transport may also be percent-encoded. Decoding the URL first, then Base64-decoding the token, reveals the JSON payload.
• Email campaign tracking links: Marketing email links typically contain several layers of URL encoding for tracking parameters (UTM parameters, click IDs, redirect URLs). Decoding reveals where the link actually points.
• SEO and analytics: Search engines pass the user's search query in the URL. Google Analytics, for example, records %D8%A8%D8%AD%D8%AB in the referrer URL — decoding reveals the Arabic word "بحث" (search).
• Security research: Malicious URLs often use percent-encoding to obfuscate payloads (e.g., XSS or SQL injection attempts). Decoding reveals the actual payload.

URL Structure — Parts of a URL

When you decode a full URL, the Toolsiro decoder automatically breaks it down into its components:

• Protocol: https: or http: — defines how the resource is accessed.
• Host: www.example.com — the domain name or IP address of the server.
• Path: /search/results — the specific resource location on the server.
• Query string: Everything after ?, containing key=value pairs separated by &.
• Fragment: Everything after # — processed by the browser, never sent to the server.

Double Encoding — A Common Problem

Double encoding occurs when an already-encoded URL is encoded again. The result is that % (itself) gets encoded as %25, so %20 becomes %2520. This is a frequent source of bugs in web applications. The Toolsiro decoder offers a "decode recursively" option that repeatedly decodes the input until no percent sequences remain — useful for detecting and unwinding multiple layers of encoding.

Related Tools

To encode a URL or text for safe transmission, use the URL Encoder. For Base64 decoding of tokens or credentials, use the Base64 Decoder.