URL Decoding Tips and the Mistakes That Break It

The three mistakes that ruin most URL decoding are treating + as a space in the wrong context, missing a double-encoded string, and choking on a malformed % that was never a real escape. This best-practices guide is for developers who decode URLs often and want to stop getting surprised by mangled output.

Know when + means space — and when it doesn't

The single most misunderstood rule: + only means a space in application/x-www-form-urlencoded data — the query strings HTML forms submit. In a URL path, + is a literal plus sign. Decode a path with plus-to-space enabled and you will corrupt filenames like c++_notes.pdf into c _notes.pdf. The habit that keeps you safe: enable "treat + as space" for query strings, disable it for paths. When in doubt, look at where the string came from — after the ? it is probably form data; before it, treat + literally.

Context	Is + a space?	Setting
Query string from a form (after ?)	Yes	Enable + as space
URL path segment	No — literal +	Disable + as space
A raw %2B	Always a literal +	Either — %2B decodes to +

Spot and unwrap double encoding

Double encoding is a frequent, sneaky bug. It happens when an already-encoded string is encoded again, so % itself becomes %25 and a space goes from %20 to %2520. The tell: after one decode pass your output still contains %XX sequences. The fix is simply to decode again — run the result back through until no escapes remain. If you decode once and see %20 in the text, that is not a failure, it is a signal to decode a second time.

Understand the 'URI malformed' error instead of fearing it

Decoding throws when a % is not followed by exactly two hexadecimal digits. Common causes: a literal percent sign in the text that was never encoded (a raw 100% done), an escape truncated when the string was cut, or a stray % in a search query. This is the decoder telling you the input is genuinely invalid, not a tool bug. Best practice is to encode literal percent signs as %25 at the source; when you are just inspecting messy input, the tool's clear error message tells you exactly where the string is broken rather than silently producing garbage.

Handle UTF-8 and privacy correctly

• Multibyte characters: accented and non-Latin text encodes as several bytes — é is %C3%A9. Proper UTF-8-aware decoding reassembles them; decoding byte-by-byte in older tools produces mojibake like é. Verify that international text round-trips.
• Sensitive URLs: URLs often carry session tokens, emails and tracking parameters. Decoding them in your browser rather than pasting into a random server keeps that data local — this tool never uploads what you decode.
• Whole URL vs one parameter: if you only need one value, extract that parameter first, then decode it, so structural characters like & and = in the rest of the URL don't confuse your reading.

Try the URL Decoder — free and 100% in your browser.

Frequently asked questions

Why did my decoded filename lose its plus signs?

You decoded a path with the plus-to-space option enabled. In a URL path + is a literal plus, so disable that option; only enable it for form-style query strings after the ?.

My output still has %20 in it — did decoding fail?

No, that usually means the string was double-encoded. Decode the result a second time; if the leftover escapes disappear, the original had an extra encoding layer.

What causes a 'URI malformed' error?

A % not followed by two hex digits — often a literal percent sign that was never encoded, or an escape cut off mid-sequence. Encode literal percents as %25 at the source to avoid it.

Why do accented characters come out garbled?

That is a UTF-8 handling problem. Multibyte characters like é (%C3%A9) must be decoded as UTF-8, not byte-by-byte. This decoder is UTF-8 aware, so international text decodes cleanly.

Related free tools

• URL Encoder — encode text safely for URLs.
• Base64 Decoder — decode Base64 payloads.
• JWT Decoder — inspect token contents.
• JSON Formatter — tidy decoded JSON parameters.

Built by ByteVancer

ByteTools is a free product of ByteVancer, a software and web development studio building web apps, SaaS and custom software. If your team needs robust handling of URLs, encoding and web data, explore what ByteVancer can build for you.