Decode URL query string online
Decode percent-encoded query strings so you can read the real values — spaces, slashes, and nested redirect URLs hidden behind %20, %2F, and %3A.
Opens URL Parser with this example preloaded. Everything runs locally in your browser.
The problem
Encoded values are hard to read and easy to mishandle. Decoding each parameter reveals the actual content, including full redirect URLs encoded inside a single parameter.
Sample input
https://example.com/search?q=hello%20world&redirect=https%3A%2F%2Fapp.example.com%2FhomeExpected output
q = hello world
redirect = https://app.example.com/home%20 decodes to a space and %3A%2F%2F decodes to ://, revealing the nested redirect URL.
How to do it
- Paste the URL or query string.
- Decode the percent-encoded values.
- Inspect each parameter.
- Copy the decoded values you need.
- Re-encode if you are putting values back into a URL.
Common mistakes
- Decoding the whole URL multiple times, corrupting already-decoded characters.
- Breaking a nested redirect URL by decoding it too aggressively.
- Treating
+as a literal plus when it means a space in a query string. - Leaving encoded slashes unread.
- Copying an unsafe redirect URL without checking where it points.
Related tools
Related guides
FAQ
What does %20 mean in a URL?
It is the percent-encoding for a space character. In a query string a + can also represent a space.
How do I decode a query string?
Paste it into the parser and decode; each percent-encoded value is converted back to its original characters.
What is percent encoding?
A scheme that represents reserved or non-ASCII characters as a % followed by two hex digits, so they can travel safely in a URL.
Should I decode a URL more than once?
No. Double-decoding can turn legitimate characters into something else and corrupt values like nested URLs.
What is the difference between encodeURI and encodeURIComponent?
encodeURI keeps URL structure characters (: / ? &) intact, while encodeURIComponent encodes them too, which is what you want for a single parameter value.
Decoding runs locally in your browser. The URL is not sent to a server.
Practical example and expected result
Decode percent-encoded query strings so you can read the real values — spaces, slashes, and nested redirect URLs hidden behind %20 , %2F , and %3A . In practice, this is most useful when you need a quick, repeatable check on a URL or query string before adding it to a ticket, pull request, test fixture, or support note.
A realistic input for this workflow is https://example.com/search?q=hello%20world&redirect=https%3A%2F%2Fapp.example.com%2Fhome. The expected result should resemble q = hello world redirect = https://app.example.com/home, with the same important values preserved.
Troubleshooting checklist
- Confirm you copied the complete URL or query string and not only a partial line or truncated preview.
- Run the local tool once with a safe sample, then repeat with the real data only if your team policy allows it.
- Check quoting, escaping, whitespace, encoding, timestamps, and environment-specific values before trusting the result.
- Before sharing output, remove secrets, tokens, cookies, customer data, and production hostnames that are not needed for the review.
Next useful steps
- Decode this URL query string → for a related validation or follow-up step.
- Encode and decode URL components for a related validation or follow-up step.
- Encode and decode common formats for a related validation or follow-up step.
- Use Magic Box when you are not sure which tool should handle the next artifact.
Review checklist before sharing the result
For Decode URL query string online, the safest workflow is to test with a small sample, confirm the output shape, then repeat with the real artifact only when needed. Keep the original input open until you verify that no value was dropped, decoded twice, sorted unexpectedly, or changed from text into a different type.
Before copying the result into a pull request, issue, chat thread, or support ticket, scan for private values. Replace real IDs, bearer tokens, session cookies, email addresses, internal hostnames, and customer data with placeholders. If another tool is listed above, use it as the second pass rather than manually editing complex output.
- Keep one line of context explaining why the transformation was needed.
- Preserve enough sample structure for a reviewer to reproduce the result locally.
- Note any assumptions about encoding, timezone, delimiter, schema version, or runtime environment.