How to Decode a URL and Read Percent-Encoded Text

Step-by-step

1. Paste the encoded text into the URL decoder.
2. Use Decode URL for a full address, or Decode Component for a single encoded value.
3. Read the result. If it reports invalid encoding, look for a lone % sign or a % followed by non-hex characters.
4. If the text was encoded twice, decode it a second time. You will see %25 where a single % was expected.
5. Check the decoded value before using it in a script or database query.

Reading common sequences

%20 is a space, %2F is a slash, %3F is a question mark, %26 is an ampersand, %3D is an equals sign and %23 is a hash. Non-English characters are encoded as several %XX groups, because they are first converted to UTF-8 bytes.

Double encoding

If you see %2520, the text has been encoded twice: %25 is an encoded percent sign. This often happens when a link passes through two systems that both encode it. Decode once for each layer.

A safety note

Decoded input is untrusted data. Never put it straight into a database query, file path or page without validating or escaping it for that context.