Processed locally

URL Decoder Online

Decode and structurally inspect URLs, query parameters, nested values, encoding layers, OAuth/MCP signals, and sensitive data entirely in your browser.

What this tool does

URL Decoder turns an encoded link into a structural inspection of its scheme, host, port, path, query, fragment, and origin. It preserves query order and duplicate keys, traces percent-decoding layers, recognizes nested URLs, highlights malformed encoding, detects OAuth/MCP callback signals, and creates a sanitized URL and AI-ready context without fetching the link or uploading its contents.

How to use

Follow the core workflow below. Use “Show in tool” to locate the real control in the live tool above.

  1. Paste an encoded URL

    Add the full or relative link to URL to inspect, then use Decode / Parse. The analyzed URL is never opened or fetched.

    URL to inspectDecode / ParseSample
  2. Inspect URL components and query parameters

    Review URL Components, then use the ordered Query Parameters table to compare decoded and raw values, duplicate occurrences, and nested URL indicators.

    URL ComponentsQuery Parameters
  3. Review decode layers and sensitive values

    Check Decode Layers and Diagnostics for repeated encoding, malformed percent sequences, sensitive values, and contextual OAuth/MCP signals.

    Decode LayersDiagnosticsOAuth / MCP Inspector
  4. Copy the decoded or sanitized result

    Use Copy decoded URL for a reviewed raw result, Copy Sanitized URL when sensitive data is detected, or Prepare AI-ready context for a fully previewed redacted export.

    Copy decoded URLCopy Sanitized URLPrepare AI-ready context
  5. Compare two URLs

    Optional

    When you need to explain a redirect or callback difference, open Compare, add URL A and URL B, then run Compare to review structural and query-parameter changes.

    CompareURL AURL BCompare

    Use this secondary path only when two URLs need to be compared.

Success

You can inspect one URL end to end, export a safe result, or compare two URLs when the debugging task requires it.

Prepare AI-ready context

Examples

Normal query URL

Inspect multiple parameters, duplicate keys, empty values, and plus-as-space query semantics.

Unicode and encoded value

Decode an encoded path or query value while preserving the original raw form for comparison.

Double-encoded redirect_uri

Trace a nested callback through two percent-decoding layers and inspect its URL structure.

Synthetic OAuth callback

Review fake code, state, iss, resource, PKCE, or OAuth-style error parameters as contextual signals.

Sensitive query values

Detect token-like parameters or JWT-looking values and copy the same URL structure with values replaced by [REDACTED].

Common errors

  • A plus sign in query/form encoding represents a space, while %2B represents a literal plus sign.
  • A value is encoded more than once, so one decoding pass still leaves percent sequences.
  • A malformed percent sequence such as % or %ZZ is treated as data instead of being decoded.
  • A redirect_uri contains a nested URL whose own query parameters need separate inspection.
  • A decoded URL is assumed to be safe even though decoding does not validate its destination or behavior.
  • An OAuth callback or token-bearing URL is copied raw into an issue, log, or chat instead of using the sanitized export.

AI workflow

Use Prepare AI-ready context to preview an agent-neutral Markdown summary containing sanitized URL facts, components, query names, safe or redacted values, encoding layers, nested URL facts, OAuth/MCP diagnostics, warnings, and explicit limitations. Raw sensitive values are never included and no external AI service is called.

Learn with this tool

Understand the concept, inspect a testable example, then open it in the tool above.

Web & EncodingURL Encoding Spaces: %20 vs + Explained

Frequently asked questions about URL Decoder