ConverterURL Decode
Decode one percent-encoding layer under a declared context. Malformed escapes and invalid UTF-8 stop with an error instead of being repaired.
Decode One URL-Encoding Layer
Enter input to begin.
The Plus Sign Is Context-Sensitive
In component mode, + is an ordinary plus character. In application/x-www-form-urlencoded mode, + represents a space and %2B represents a literal plus.
The decoder runs once. If output still contains % escapes, that may be literal data or a deliberately nested encoding layer; it is not recursively decoded.
Malformed Input Policy
| Input | Outcome |
|---|---|
| %ZZ | Invalid percent escape |
| %E2%28%A1 | Invalid UTF-8 byte sequence |
| %2520 | Decodes once to %20 |
| a+b in component mode | a+b |
| a+b in form mode | a b |
Use Decoded Text As Untrusted Input
- Decoding does not authorize a redirect or validate a URL.
- Apply the destination context policy after decoding.
- Keep the original encoded value for debugging double-encoding problems.
Questions About This Tool
Component mode treats + literally. Only form mode maps + to a space.
No. One pass produces %20; a second decode must be an explicit workflow decision.
The conversion stops and reports an error rather than inserting replacement characters.