urltoolskit.org
URL utilities, in the browser
Say hi →

Double / multi URL decoder

peel every layer of percent-encoding · one pass at a time

A URL that went through two systems often comes back with %253A instead of %3A — that is % itself encoded, one layer too many. Paste it here and each decode pass is shown separately, so you can see how deep the nesting went and stop at the layer you actually wanted.

Decode passes

Ready.

How to use

  1. Paste the over-encoded URL into the input. Decoding starts as you type — there is no Run button.
  2. Read the Decode passes list from top to bottom. Pass 1 is one decodeURIComponent, pass 2 is two, and so on.
  3. Each pass has its own Copy button, so you can grab the intermediate layer if that is the one your API expects.
  4. Tick Treat + as a space when the string came from an HTML form or a application/x-www-form-urlencoded body.
  5. The status line tells you how many times the URL was encoded and why decoding stopped.

How to tell you have a double-encoding problem

Look for %25 in the string. %25 is an encoded %, so %253A reads as "encoded percent, then 3A" — decode once and you get %3A, decode again and you get :. Other giveaways: %2520 (double-encoded space), & mixed with %26, and query strings where the value contains a whole visible URL with %3A%2F%2F in it.

Double encoding usually happens when one layer of your stack encodes a value that was already encoded — a redirect wrapper, a logging proxy, or a client that calls encodeURIComponent on a URL it received rather than on a raw value.

FAQ

Why does decoding stop before the max pass count?

It stops as soon as there are no %XX escapes left, or when a pass would produce the same string it started with. Both mean you have reached the real value. If a pass hits an invalid escape (a lone %, or %ZZ), decoding stops there and the status line says which pass failed.

Is decoding twice ever the right fix in production?

No. Decoding twice on the server is how open-redirect and path-traversal filters get bypassed — the filter sees a clean string and the next layer decodes it into something else. Use this tool to diagnose where the extra encoding is coming from, then fix that layer.

What is the difference from the normal decoder?

The URL encode / decode tool does exactly one pass, which is what you want most of the time. This one loops and shows the intermediate states.

Does anything get uploaded?

No. The decoding is plain JavaScript in your tab — you can watch the Network panel stay empty.