Decode a Nested Redirect URL
Decode a return_to / redirect parameter that is itself a URL. See the real destination hidden behind percent-encoding.
Part of the free URL Decoder. Runs in your browser — nothing is uploaded.
Decode a Nested Redirect URL
OAuth and login flows pass the destination as a query value, so the whole URL is percent-encoded. Decode that parameter to see where the user will land — and to spot open-redirect bugs.
Worked example: A return_to value
Encoded
https%3A%2F%2Fapp.example.com%2Fsettings%3Ftab%3Dbilling
Decoded
https://app.example.com/settings?tab=billing
Practical tip
After decoding, check the host. If it is not a host you own, do not redirect there.
How to use this URL Decoder
- 1Use the live tool above — it runs entirely in your browser and never uploads your data.
- 2Paste the sample from the worked example, or use your own input.
- 3Copy the result, then adapt the same steps in your editor, script, or pipeline.
Decode a Nested Redirect URL FAQs
Why is the redirect encoded twice?
Some proxies encode an already-encoded URL. Decode until you see a readable http(s) URL, then stop.
Is decoding a redirect URL safe?
Decoding is safe. Following an unvalidated decoded URL is not. Allow-list destinations on the server.
More URL Decoder pages
- URL Decode %20 to SpacesDecode %20 and other percent-encoded bytes back to readable text. Paste an encoded URL or query value.
- Decode a Query String OnlineDecode a full query string and read every parameter. Turns %XX sequences back into readable values.
- decodeURIComponent OnlineRun decodeURIComponent on any string. Catch malformed % sequences and see the exact JavaScript result.
- Decode + as a SpaceTreat + as a space before percent-decoding, the same way HTML form bodies are decoded.
- Decode UTF-8 Percent-EncodingDecode percent-encoded UTF-8 back to accents, CJK characters and emoji. See caf%C3%A9 become café.
- Parse URL Query ParametersSplit a URL into protocol, host, path and a table of query parameters. Decode each value automatically.
- Fix Malformed Percent-EncodingSee why decodeURIComponent throws on a trailing % or a lone %2, and how to clean the string before decoding.
- Bulk URL DecoderDecode many percent-encoded lines at once. Paste a list of values or URLs and decode each line.
- Decode + and % Sequences TogetherDecode strings that mix + (form space) and %HH sequences. The usual case for query strings from HTML forms.