Browser 106

no file limit

Inspector security/url-decode

URL Decoderen

Overview

URL Decode turns percent-escapes — %20, %2F, %3D and the rest — back into the characters they stand for, for a full address, a query string or a fragment pasted from a log, a browser bar or an API response. Three modes match the three places encoded text comes from: whole URL keeps the structure intact, query value treats the input as a single parameter, and form reads + as a space, which is what an application/x-www-form-urlencoded body means by it. When a % is not followed by two hex digits, you are told where in the input it sits rather than being handed text that silently decoded past the problem. The two panes are linked, so an edit on the decoded side shows what it would encode back to. Nothing is uploaded; decoding happens in your browser.

Debugging API RequestsPaste a raw request URL from a network log or curl output and read the query parameters as they were meant, rather than as a wall of escapes.
Unwrapping a Redirect ChainDecode the nested destination URLs that sit inside redirect parameters, one layer at a time, to see where a link actually leads.
Reading Form DataDecode an application/x-www-form-urlencoded POST body in form mode, so + comes back as a space instead of as a literal plus.
Examining an Obfuscated PayloadSecurity reviewers decode escaped or double-escaped sequences in a suspicious URL to see what was being smuggled, without sending the sample to an external service.
Fixing a Mangled LinkRecover a readable address from an unsubscribe or tracking URL copied out of an email, and see exactly which escape is malformed if it will not decode.

Set

Beveiligingstools 26

Neighbours

01 AES Bestand & Tekst Encryptor 02 Base64 Decoderen 03 Base64 Coderen 04 CSR Generator 05 DER naar PEM Converter 06 Hash Generator

Specification

Command: security.url_decode
Set: Security
Input: text
Output: —
Max. bestand: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Zoeken: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Paste the encoded text

Percent-encoded on one side, readable text on the other. Editing either pane updates the other, so you can check what an edit would encode back to.

Choose the mode that matches the source

Whole URL keeps the structure intact, query value treats the input as a single parameter, and form reads + as a space — which is what a submitted HTML form actually sends.

A broken escape is located, not just rejected

When a % is not followed by two hex digits, you are told where in the input it sits, so you can fix that character instead of working out which one failed.

Frequently asked

How do I recognise URL-encoded text?

Look for % followed by two hexadecimal digits: %20 for a space, %26 for &, %3F for a question mark. A run of them in a row usually means non-ASCII text, since every such character is encoded as two or three UTF-8 bytes.

Is URL decoding safe?

Decoding only turns escapes back into the characters they stand for; it does not execute or fetch anything. It runs in your browser, so a URL carrying a session token or a signed parameter can be decoded without sending it anywhere.

What if the encoded text is malformed?

A % that is not followed by two hex digits is reported along with the position in the input where it sits, so you can fix that one character instead of working out which of a hundred escapes failed. Guessing past a broken escape would hand you text that looks right and is not.

Which mode should I choose?

Whole URL keeps the structure intact and suits an address copied from a log or a browser bar. Query value treats everything you paste as a single parameter, which is what you want for a URL that was carried inside another one. Form reads + as a space, which is what a submitted HTML form means by it.

Keys

Zoeken: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Gerelateerd · Beveiligingstools