Percent-encoding represents a byte as a percent sign followed by two hexadecimal digits. UTF-8 text may therefore use several escapes for one character. This decoder applies decodeURIComponent semantics and rejects incomplete escapes instead of guessing at corrupted bytes.
Repeated encoding is where a useful transport format becomes a security boundary. Text validated in its outer form can reveal a delimiter or markup only after a later component decodes it again. tryb shows every layer so you can see what the next decoder in a request path would receive.
Decoding is deliberately bounded at three passes. That limit prevents an input wrapped in dozens of layers from consuming unbounded work and avoids presenting recursive decoding as normal application behavior. If escapes remain, the result says so explicitly.
Edge cases worth knowing
- Nested percent signs
- %2520 decodes first to %20 and then to a space. The intermediate layer is retained so the transformation is auditable.
- Malformed UTF-8
- A syntactically complete escape sequence can still describe invalid UTF-8. The decoder declines it rather than replacing bytes silently.
- Encoded query strings
- A complete key-value query is ranked above this generic decoder, while the percent-decoded interpretation remains available as a secondary card.
Common mistakes
- Decoding repeatedly until no percent sign remains without a pass limit.
- Validating only the outer encoded form and using a later decoded value in HTML, SQL, or a path.
- Treating every percent sign in prose as URL encoding.
- Assuming percent-encoding is encryption or makes sensitive text safe to log.