URL Param Decoder

Percent-encoding (URL encoding) rewrites characters that are unsafe or reserved in a URL as a % sign followed by two hexadecimal digits, for example %20 for a space and %26 for an ampersand. URLs may only contain a limited ASCII set, so spaces, punctuation, non-Latin scripts, and reserved characters like ? & = # must be escaped before transmission. This tool reverses that process: it reads each %XX sequence as UTF-8 bytes and shows you the original characters.

Both can mean a space, but they come from different conventions. In HTML form submissions (application/x-www-form-urlencoded), a space is sent as +. In the stricter RFC 3986 percent-encoding used elsewhere in a URL, a space is %20 and a literal plus must be written as %2B. Mixing them up is a classic bug: decoding with the wrong rule turns real plus signs into spaces or leaves spaces as +. This tool defaults to the form convention (+ becomes a space) because most query strings come from forms, and you can toggle it off to keep plus signs literal.

Double encoding happens when an already-encoded value is encoded a second time: the % of each %XX sequence is itself encoded as %25, so a colon becomes %253A instead of %3A. One decode pass then gives you %3A, not :, which looks broken. This tool decodes repeatedly until the value stabilizes (up to 5 passes) and reports how many passes it needed, so a value that took 2 passes is flagged as double-encoded and you can see every layer of the unwrapping.

The query string is the part after ? and before #; it is sent to the server. The fragment is everything after #; it never leaves the browser and is only visible to JavaScript on the page. Tracking parameters placed after # therefore never reach your analytics backend, a common silent failure. This tool parses only the query string, strips the fragment, and warns you if the fragment itself looks like it contains parameters so you can move them.

Each occurrence becomes its own row in the original order, and the table shows an occurrence count per key (for example id appearing 3 times). Nothing is merged or overwritten, because servers and frameworks disagree on what ?id=1&id=2 means: PHP keeps the last value, some frameworks collect an array, others keep the first. Showing every occurrence lets you decide which interpretation your backend uses.

Yes. All decoding runs in JavaScript inside your own browser: there is no upload, no API call, no analytics beacon, and nothing is stored or logged. You can disconnect from the network after the page loads and decoding keeps working. Separately, decoded values are inserted into the page as plain text, never as HTML, so a malicious payload like <script> in a parameter is displayed harmlessly instead of executed — this is the XSS-safety guarantee.

This tool decodes any query string: it shows raw versus decoded values, encoding types, double-encoding layers, and duplicate keys for every parameter. The UTM Parameter Parser is a campaign specialist: it validates utm_source, utm_medium, utm_campaign, utm_term, and utm_content against naming conventions, detects click IDs like gclid and fbclid, batch-parses many links at once, and builds campaign URLs. This page flags utm_* parameters when it sees them and links to the UTM parser for full campaign validation.

The Query String Parser is a URL analyzer: it decomposes a full URL into protocol, host, path, and hash, and lets you inspect and edit the query structure. This URL Param Decoder is decode-focused: it answers 'what does this encoded value actually say?' with a raw-versus-decoded table, per-parameter encoding detection, multi-pass unwrapping of double-encoded values, and occurrence counts for repeated keys. Use the parser to take a URL apart; use this decoder to read what is inside its parameters.

It means the input was not produced by a correct encoder: % must always be followed by two hexadecimal digits. A %ZZ sequence or a % stranded at the end of a value is a bug upstream, often from hand-built URLs or a broken concatenation. Instead of crashing or silently dropping data, this tool leaves the raw text untouched and flags the value as an invalid escape so you can see exactly where the encoding broke.