How to fix malformed or double-encoded URLs

Double-encoding happens when code calls encodeURIComponent on a string that is already percent-encoded, turning %20 into %2520. The receiving server decodes once and gets %20 as a literal string instead of a space. This is one of the most confusing URL bugs to track down. This guide shows how to identify double-encoding and decode a URL back to its intended form.

Step-by-step guide

1. Spot the double-encoding pattern: Look for %25 in your encoded string — %25 is the encoding of a literal %, so %2520 means the original had %20 which was encoded again. Other common patterns: %253A (double-encoded :) and %252F (double-encoded /).
2. Decode once to reveal the intermediate form: Paste the double-encoded string and select 'decode'. The output will show the single-encoded form (e.g. %20 for a space). Decode again if still encoded, or read the output as the intended plain text.
3. Fix the root cause in code: In your code, avoid calling encodeURIComponent on a value that is already encoded. Decode the value first with decodeURIComponent, then re-encode exactly once. Use this tool to verify the final encoded form before deploying.

Frequently asked questions

How many times should I decode to get the original string?

Decode until the output stops changing. Each decode pass removes one round of encoding. If the string was double-encoded, two decode passes return the original. Use this tool iteratively — paste the output back as input — to find the original value.

Can I safely decode a URL that might not be encoded?

Yes, with one caveat: decodeURIComponent throws on invalid sequences (a % not followed by two hex digits). This tool handles that gracefully and returns the input unchanged. For a plain string with no % sequences, decoding is a no-op — the output equals the input.