Decode one percent-encoded URI or form field component with explicit plus handling, strict malformed-input errors, and inert output.
A quick decision brief for this specific tool
URL Encoded Input
Decoded
A dedicated interactive panel for this data format or operation
Choose your path
Decode exactly one percent-encoded component under an explicit URI-component or form-urlencoded-field context, preserving literal plus where required and rendering the result only as untrusted text.
Decode one component after structural parsing without turning reserved delimiters into new URL structure.
Choose URI-component context, paste the exact encoded value, decode once and save the context with the result.
Literal plus remains plus and percent triplets decode exactly once.
Apply the form-urlencoded plus-as-space rule only when that media-type context is known.
Select form field context, compare `+` with `%2B`, and retain the explicit mode in the warning record.
Spaces and literal plus signs remain distinguishable.
Prevent decoded delimiters, markup, controls or redirect text from being executed or trusted.
Use named context/input/output controls, inspect malformed percent errors and treat output as inert text.
No navigation, markup rendering, double decoding or safety approval occurs.
Outputs and checklists are planning aids. Review the linked current authorities and the records, terms, instructions, and requirements that apply to your exact situation before a consequential decision.
This tool is part of these guided projects. Each project provides step-by-step instructions with checklists and all the tools you need in one place.
Tools you might need next
Percent-encode one Unicode URI component with encodeURIComponent semantics, explicit context limits, and malformed UTF-16 rejection.
Strictly decode standard or URL-safe Base64 into UTF-8 text, with explicit malformed-input errors and an untrusted-output security boundary.
Parse a JWT locally to inspect its segments and claims. Decoding alone does not verify signature, issuer, audience, expiry, authorization, or trust.
URI-component mode passes plus through unchanged. Form-urlencoded field mode first converts plus to space, while `%2B` still decodes to a literal plus.
decodeURIComponent performs one percent-decoding pass and rejects malformed escapes or UTF-8. The Tool does not normalize, navigate, reparse, or decode the result again.
Decoded characters are placed in a read-only text control. Markup, delimiters and control-like output are not rendered, executed, opened, authenticated, or authorized.
Updated: August 2026
A developer decodes `a+b%2Bc` in both modes, recording `a+b+c` for URI-component context and `a b+c` for form-field context.
After the application separates URL structure, a reviewer decodes one encoded value exactly once and checks it against receiver-side validation.
A security reviewer confirms invalid escapes fail and markup-like decoded text stays inert rather than becoming navigation or rendered content.
Decode exactly once after choosing URI-component or application/x-www-form-urlencoded field context. Split complete URLs before decoding and treat every result as untrusted text.
