How percent-decoding works
Each %XX in a URL is one byte written in hexadecimal. Consecutive bytes are then read as UTF-8, so %C3%A9 is two bytes that together mean é, and %F0%9F%98%80 is four bytes for 😀. Decoding a single byte out of a multi-byte sequence fails, which is why this tool reports malformed sequences instead of silently producing junk.
In HTML form submissions (application/x-www-form-urlencoded) a space is written as +. Turn on "+ means space" when decoding query strings from forms; leave it off for path segments, where + is a literal plus.
Frequently asked questions
What does %20 mean?
%20 is a space: 20 is the hexadecimal byte for the space character in ASCII and UTF-8.
Why do I see %25 in my URL?
%25 is an encoded percent sign. Seeing %2520 means the text was encoded twice (%20 → %2520). Use "Decode again" to peel off each layer.
Why does decoding fail with "malformed"?
A % not followed by two hex digits, or bytes that do not form valid UTF-8 (for example text originally encoded in Latin-1), cannot be decoded as UTF-8.
Is the URL sent anywhere?
No. Decoding runs in your browser, which matters when URLs contain tokens or personal data.