Decode or encode a URL, including the wrapped and double-encoded ones.
Paste percent-encoded text to read it, or plain text to encode it. It keeps decoding until the string stops changing, and pulls the real destination out of an Outlook SafeLinks or Proofpoint link without ever fetching it.
The interactive tool loads with this page and runs entirely in your browser.
%2520 is the reason most people end up here
A space is %20. Encode that string a second time and the percent sign itself gets encoded, because % is %25, so %20 becomes %2520. Decode it once and you are looking at %20, which looks like it failed even though it worked.
It happens whenever a value is encoded by two things that each assume they are the first: a form library and then a redirect builder, an analytics tag and then an email platform, a proxy that encodes what it forwards. This tool keeps decoding until the string stops changing and tells you how many passes that took. Two passes means one encoder too many somewhere upstream, and that count is usually the fastest way to find it.
Encoding a whole URL and encoding one value are different jobs
This is the encoding mistake that produces broken links, and it is a single wrong choice rather than a subtle bug.
A whole URL has to keep its structure. The characters : / ? & = # are what make it a URL, so encoding them turns the address into a meaningless string. That is what the whole-URL mode leaves alone.
One value inside a URL is the opposite. If a redirect parameter carries a destination that itself contains a &, and that & is not encoded, the destination ends early and everything after it becomes a separate parameter on the outer link. Anything going inside a query string needs the single-value mode, which escapes the structural characters precisely so they cannot be read as structure.
The rule of thumb: if the thing you are encoding will sit after an = in someone else's URL, it is a value.
A plus sign is genuinely ambiguous
In a form submission, a space is written as +. In a path, + is a literal plus sign. Both are correct, in different places, and nothing in the string itself says which one you are holding. A decoder that silently picks one is guessing on your behalf, and the guess is wrong often enough to matter: it is why an email address with a plus tag, name+tag@example.com, sometimes arrives as name tag@example.com.
So it is a switch here rather than a default. Turn it on for anything copied out of a form body or a POST payload, and leave it off for a path or a filename.
When an escape is malformed, the position is the useful part
A % must be followed by exactly two hex digits. A bare percent sign in text, like 50% off, is not valid percent-encoding, and every browser API answers that with URI malformed and nothing else. That message does not tell you which character to look at, which is the only thing you needed.
This one names the offending sequence and its position in the string. It also separates the two different failures that get reported the same way everywhere else: an escape that is badly formed, and escapes that are well formed but spell bytes that are not valid UTF-8. The second usually means the text was encoded from a different character set, which is a completely different problem with a completely different fix.
SafeLinks, URL Defense and the rest of the email wrappers
Corporate mail filters rewrite every link in every message so the click goes through them first. Outlook SafeLinks turns a twelve-character link into four hundred characters. Proofpoint URL Defense does the same with a different encoding. The effect is that the one thing a person needs in order to judge a link, where it goes, is the one thing they can no longer see.
Paste one of those in and the destination comes out, because it is already in the string. A SafeLinks URL keeps the original in a parameter called url. URL Defense v1 and v2 keep it in u, and v2 swaps - for % and _ for / on the way in, which is why it looks unreadable and is not. Barracuda Link Protect uses a. Nested wrappers are unwrapped one layer at a time, which is what a message forwarded between two filtered organisations looks like.
Nothing is fetched to do this. That matters more than it sounds: the safe way to inspect a suspicious link is to read it without visiting it, and every hop here is worked out from the text you pasted.
One wrapper genuinely cannot be undone. Mimecast issues a token and keeps the mapping on its own servers, so the destination is not in the link at all. This says that by name rather than handing back the wrapper as though it were the answer.
Everything happens in the tab
Nothing is uploaded, so nothing is logged. That matters more here than on most tools, because the strings people decode are often signed URLs, session tokens and redirect payloads that were never meant to be pasted into someone else's server.
Trace a link's full redirect chain.See every hop in a redirect chain and catch dropped UTM tags and click IDs before they cost you attribution.
Questions
What is URL encoding?
It is the rule that lets any text travel inside a URL. Characters a URL uses structurally, and anything outside a small safe set, are replaced by a percent sign and two hex digits standing for their UTF-8 bytes. A space becomes %20 because a raw space would end the URL.
Why does my string still have %20 in it after decoding?
Because it was encoded twice. %2520 decodes to %20 on the first pass and to a space on the second. This tool keeps going until the string stops changing and tells you how many passes it took, so a double-encoded value comes out readable in one step.
Should I use whole-URL or single-value encoding?
If you are encoding a complete web address, use whole URL: it leaves : / ? & = # intact so the address still works. If what you are encoding will sit after an = inside someone else's URL, use single value, which escapes those characters so they cannot break the outer link.
Does a plus sign mean a space?
In form data, yes. In a path, no, it is a literal plus. Nothing in the string says which one it is, so this offers it as a switch rather than guessing. It is the reason an address like name+tag@example.com sometimes arrives with a space in it.
Why do I get an error on a string with a percent sign in it?
A percent sign must be followed by two hex digits to be valid, so text like 50% off is not decodable as-is. A literal percent sign is written %25. This tool names the exact sequence and its position rather than just saying the URI is malformed.
How do I decode an Outlook SafeLinks URL?
Paste the whole thing in. SafeLinks keeps the original link in a parameter called url, so the destination is already in the string and comes straight out. Nothing is fetched to work it out, which is what makes it safe to inspect a link you do not trust.
Can this decode a Proofpoint URL Defense link?
Yes, for v1, v2 and v3. v2 is the one that looks like gibberish: it swaps - for % and _ for / before encoding, so it is readable once those are put back. v3 carries the URL literally between double underscores, and any * in the result stands for a character v3 moved into its encoded tail.
Why will it not decode my Mimecast link?
Because the destination is not in the link. Mimecast issues a token and keeps the mapping on its own servers, so no offline tool can resolve it. The tool says that by name rather than handing the wrapper back as if it were the answer.
What is the difference between this and the link decoder?
This one works on text, including a fragment of a URL or a value that is not a link at all. The link decoder takes a complete URL apart and explains what each tracking parameter on it is for, who set it and whether it identifies you.
Is anything I paste stored or sent anywhere?
No. Encoding and decoding both run in your browser, and nothing leaves the tab. Signed URLs and session tokens are common inputs here, which is exactly why that matters.
Give your bio link a brain.
Build your page, watch who converts, free to start.