How to Decode URL-Encoded (%XX) Strings
URL Decoding
When to URL-Decode
Decode percent-encoded strings when reading query parameters from logs, debugging redirect chains, parsing copied URLs, or inspecting API request payloads.
Real-World Examples
hello%20world → hello world
q=c%2B%2B%20tutorial → c++ tutorial
redirect=https%3A%2F%2Fexample.com → readable URL for inspection
Common Mistakes
- Decoding an entire URL and breaking its structure
- Decoding twice — produces corrupted output the second time
- Assuming
+always means space (depends on context)
Edge Cases
- Malformed sequences like
%GGcause decode errors - Partial strings copied from browser bars may include fragments or hash values
- Multi-byte UTF-8 characters decode from multiple %XX groups
Developer Tips
- JavaScript:
decodeURIComponent() - Log both encoded and decoded values when debugging OAuth redirect issues
Frequently asked questions
Why do I get URI malformed errors?
The input likely contains incomplete percent sequences, stray % characters, or was decoded already.
Does + decode to a space?
In application/x-www-form-urlencoded query strings, + often represents a space. decodeURIComponent treats + literally unless you replace + with spaces first.
Can I decode a full URL safely?
Decode individual components (query values, path segments) rather than the entire URL string at once.