Decode URL query string online
Decode percent-encoded query strings so you can read the real values — spaces, slashes, and nested redirect URLs hidden behind %20, %2F, and %3A.
Opens URL Parser with this example preloaded. Everything runs locally in your browser.
The problem
Encoded values are hard to read and easy to mishandle. Decoding each parameter reveals the actual content, including full redirect URLs encoded inside a single parameter.
Sample input
https://example.com/search?q=hello%20world&redirect=https%3A%2F%2Fapp.example.com%2Fhome
Expected output
q = hello world
redirect = https://app.example.com/home
%20 decodes to a space and %3A%2F%2F decodes to ://, revealing the nested redirect URL.
How to do it
- Paste the URL or query string.
- Decode the percent-encoded values.
- Inspect each parameter.
- Copy the decoded values you need.
- Re-encode if you are putting values back into a URL.
Common mistakes
- Decoding the whole URL multiple times, corrupting already-decoded characters.
- Breaking a nested redirect URL by decoding it too aggressively.
- Treating
+as a literal plus when it means a space in a query string. - Leaving encoded slashes unread.
- Copying an unsafe redirect URL without checking where it points.
Related tools
Related guides
FAQ
What does %20 mean in a URL?
It is the percent-encoding for a space character. In a query string a + can also represent a space.
How do I decode a query string?
Paste it into the parser and decode; each percent-encoded value is converted back to its original characters.
What is percent encoding?
A scheme that represents reserved or non-ASCII characters as a % followed by two hex digits, so they can travel safely in a URL.
Should I decode a URL more than once?
No. Double-decoding can turn legitimate characters into something else and corrupt values like nested URLs.
What is the difference between encodeURI and encodeURIComponent?
encodeURI keeps URL structure characters (: / ? &) intact, while encodeURIComponent encodes them too, which is what you want for a single parameter value.
Decoding runs locally in your browser. The URL is not sent to a server.