URL Decode

A URL crammed with %20, %3A and %2F is unreadable at a glance, and that is usually exactly when you need to read it — while debugging a redirect, checking a tracking link, or working out what an API actually received.

Decoding a URL

1. Paste the encoded URL or query string.
2. Decode it.
3. Read the plain-text result.
4. Decode a second time if the output still contains percent sequences — that means it was double encoded.
5. Watch for + characters, which represent spaces in query strings.

Spotting a double-encoding bug

If your decoded output still looks encoded, you have found a real problem rather than a display quirk. Seeing %2520 is the classic signature: the original %20 had its percent sign encoded as %25, meaning something ran the encoder twice.

This normally happens when a value is encoded by application code and then encoded again by a framework, a redirect handler or a link builder. It surfaces as data containing literal %20 strings where spaces should be, and it is much easier to find once you know what you are looking at.

When decoding helps

• Reading redirect chains where the destination is embedded as a parameter.
• Checking what a tracking or affiliate link is really pointing at before you click.
• Debugging an API request that arrived with mangled parameter values.
• Reading server logs, where every request line is stored encoded.
• Auditing OAuth callback URLs, which nest encoded URLs inside encoded URLs.

A quick safety note

Decoding a suspicious link to see where it really points is a genuinely useful habit, since shorteners and redirect chains routinely hide the destination. Decoding is safe — it is just text transformation. Visiting the destination is a separate decision, and one worth making deliberately.

URL decoding questions