{{ summaryHeading }} {{ summaryPrimary }} {{ summaryLine }} {{ kindBadge }} {{ passBadge }} {{ cleanupBadge }}

One value only. Increase decode passes only when a nested escape such as %2520 remains.
Decoded automatically; no value is fetched or submitted.
Auto detect recognizes absolute and host-like URLs. Explicit Text bypasses URL parsing and cleanup.
Use one pass first. More passes can turn encoded data into URL separators.
Use form/query handling; leave off when plus may be literal.
{{ plus_is_space ? 'Plus decoded as space' : 'Plus kept literal' }}
No change is safest for inspection; NFC or NFKC can help comparisons.
No change preserves the parsed scheme. Text output is unaffected.
Keep all preserves original multiplicity and order.
Example: id,lang,q. Blank leaves every key eligible.
Example: sid,session,token. Matching is case-insensitive.
{{ output }}

{{ outputExportStatus }}

PartNameValueReviewCopy
{{ row.part }}{{ row.name }}{{ row.value }}{{ row.review }}

{{ structureExportStatus }}

#CharCode pointUTF-8ClassCopy
{{ row.position }}{{ row.display }}{{ row.code_point }}{{ row.utf8 }}{{ row.character_class }}

The visible/exported audit is capped at 2,000 characters; the chart and total count still cover the full decoded output.

{{ characterExportStatus }}

{{ chartExportStatus }}

{{ payloadSummary }}

{{ payloadText }}

{{ payloadExportStatus }}

Scan only after checking the decoded destination; the QR contains the same output shown in the first tab.

{{ qrExportStatus }}

{{ workflowAnnouncement }}

Uniform Resource Locator (URL) Encoder Encode URL components, complete links, form values, or paths with context-aware percent escapes, UTF-8 byte details, and local query checks.
Image to Base64 Encoder Turn an image into Base64 or a Data URI in your browser, preserve the original bytes or optimize the image, and judge whether inline use fits.
Hreflang Tag Generator Build reciprocal hreflang clusters from locale and URL rows with HTML, sitemap, or HTTP output plus self-reference and duplicate checks.
UTM URL Generator Build a campaign URL with consistent UTM tags while preserving useful query values and flagging naming, channel, or length issues.

A percent-encoded URL can hide the characters that give an address its structure. A sequence such as %2F represents a slash byte, while %3F represents a question mark. Decoding those sequences makes a link readable, but it can also turn ordinary-looking data into path separators, query syntax, or a fragment marker.

URLs combine several parts with different jobs. The scheme selects a protocol, the host identifies a destination, the path names a resource, the query carries key-value data, and the fragment points to client-side state or a document location. User information can also appear before the host, although embedding credentials there is risky and uncommon.

Percent escape
A percent sign followed by two hexadecimal digits, interpreted as one encoded byte.
Reserved character
A character such as /, ?, #, &, or = that can change URL structure.
Normalization
A deliberate rewrite that makes selected URL or Unicode forms more consistent, sometimes at the cost of exact original spelling.

Readable does not mean safe. Decoding never proves that a host is trustworthy, a redirect is harmless, or a query value contains no secrets. Check the destination spelling and the final parameters before opening, sharing, or turning the result into a QR code.

How to Use This Tool:

Decode one URL or text value at a time, beginning with the least destructive settings.

  1. Paste the encoded source and leave Mode on Auto detect unless the value must be treated strictly as a URL or as plain text.
  2. Start with one decode pass. Increase the 1 to 12 pass limit only while a nested escape such as %2520 remains. Decoding stops early when another pass makes no change.
  3. Apply cleanup deliberately. Use query allow/block lists, tracker removal, duplicate handling, or host/path changes only after checking the first decoded result.
  4. Review the decoded output and structure. Check the host, scheme, query pairs, Unicode characters, and changed-pass count before using Open URL or a QR handoff.

Interpreting Results:

The decoded value is the text produced after the selected passes and cleanup rules. The changed passes count can be smaller than the chosen limit because processing stops once the string is stable.

  • Confirm the serialized host when an internationalized domain name is displayed as Unicode; similar-looking characters can belong to different domains.
  • Treat a cleanup count above zero as a reminder that the output is no longer an exact textual copy of the decoded source.
  • An available Open URL action means the result is a hierarchical HTTP or HTTPS URL. It is not a destination safety verdict.
  • The character audit shows at most 2,000 rows, while the total character count and class summary still cover the full output.

Technical Details:

Percent-decoding converts valid hexadecimal byte escapes to Unicode text. Each pass works on the result of the previous pass, so a double-encoded sequence can expose syntax only after the second pass. If the whole string contains a malformed escape, valid runs of percent-encoded bytes are still decoded where possible and the remaining text is preserved.

Transformation Core:

The order matters because later URL parsing and cleanup see the characters produced by earlier stages.

Stage Operation Important boundary
1Repeat percent-decoding1 to 12 selected passes; stop when unchanged
2Apply optional NFC or NFKC Unicode normalizationNo normalization is the exact-inspection default
3Interpret as URL or textForced URL mode rejects a value that cannot be parsed
4Apply URL cleanup and rebuild query pairsSkipped entirely for text output
5Build structure, character, payload, and QR evidencePayload preview is capped at 100,000 characters; QR is available through 2,000 output characters

In parsed query pairs, plus signs follow form/query convention and become spaces before the pairs are serialized again. The Treat + as space option also applies that convention during the main decode, which matters for text and encoded URL components where a plus may otherwise be literal.

Reserved-Character Map:

Escape Decoded character Possible structural effect
%2F/Separates path segments
%3F?Starts a query
%23#Starts a fragment
%26&Separates query pairs
%3D=Separates a query key from its value
%25%Can reveal another escape on a later pass

Rule Core:

Hierarchical URL cleanup follows a fixed order. Scheme replacement comes first, followed by user-information removal, host lowercasing, one leading www. removal, default-port removal, repeated-slash collapse, trailing-slash trim, and fragment removal. Query rules then run in this order:

  1. Keep only allow-listed keys when an allow-list is present.
  2. Remove block-listed keys.
  3. Remove utm_* and the supported common click identifiers when tracker stripping is enabled.
  4. Remove empty values when requested.
  5. Keep all duplicates, the first occurrence, or the last occurrence. Key comparison is case-insensitive.
  6. Optionally sort by lowercase key and then lowercase value.

Source text is limited to 262,144 characters. Character counts use Unicode scalar values, and each audit row includes the code point, UTF-8 bytes, and one exclusive class such as unreserved, reserved syntax, non-ASCII, or whitespace.

Privacy Notes:

Decoding and inspection stay in the current browser until an external action is chosen. Opening the URL or scanning its QR code causes the destination device to contact the decoded address.

  • Remove embedded user information and sensitive query values before sharing a result.
  • Tracker removal covers a defined list of common keys; it cannot identify every analytics, session, or redirect parameter.
  • Unicode display and normalization aid review but do not detect phishing or certify domain ownership.

Worked Examples:

Nested search link with a campaign tag

Decoding https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dcoffee%2520beans%26utm_source%3Dnewsletter once reveals an HTTPS URL whose search value still contains %20. URL parsing preserves that encoded space when the query is rebuilt. Enabling Strip common trackers removes utm_source; leaving cleanup off keeps it for an exact first review.

References: