XML URL Decode
Decode percent-encoded XML back into readable markup. It runs entirely on your device — nothing is uploaded.
Example
Input
%3Ca%20b%3D%221%22%2F%3E
How it works
Percent-sequences are decoded back into the original XML characters.
Good to know
XML URL Decode takes XML that has been percent-encoded (the kind of %3C, %20, %22 sequences you see when markup is stuffed into a query string or copied out of a server log) and turns it back into readable tags and attributes. For example, %3Ca%20b%3D%221%22%2F%3E becomes <a b="1"/>. It is aimed at developers debugging API requests, webhook payloads, SOAP calls, sitemap parameters, or any system that ships XML inside a URL.
Reach for it whenever XML has gone through URL encoding and is no longer human-readable: a captured network request, a log line, a callback URL, or a value pasted from a browser address bar. Because the whole process runs in your browser and nothing is sent to a server, it is safe for payloads that contain internal endpoints, tokens, or other data you would not want to paste into a remote site.
Reading the result is straightforward — the output is the literal characters that the percent-sequences stood for. Keep in mind that this is URL decoding only, not XML entity decoding: a decoded < stays as < rather than collapsing into <, because those are XML escapes, not URL escapes. A few things worth knowing:
+ may represent a literal plus or an encoded space depending on where the string came from (form-encoded data uses + for space); check your source if a space looks wrong.- If decoding fails or leaves stray
% signs, the input was likely double-encoded — run it through the tool a second time.
Once you have clean markup, pair this with the XML Formatter or XML Validator to pretty-print and confirm the decoded document is well-formed before using it.
Frequently asked questions
Is my data uploaded anywhere?
No — everything runs in your browser. Your code never leaves your device, so it's safe for private work and runs offline once loaded.
Is this tool free?
Yes, completely free with no sign-up and no limits.
People also ask
What is the difference between URL decoding and XML decoding?
URL decoding converts percent-sequences like %3C and %20 back to characters such as < and a space, and is about how text is transported in a URL. XML decoding (unescaping) converts XML entities like < and & back to < and &. This tool does URL decoding only.
Why does my XML have %3C and %3E in it?
%3C is the percent-encoded form of < and %3E is >. They appear when XML is placed in a URL, query parameter, or anywhere reserved characters must be escaped so the URL stays valid.
How do I decode double-encoded XML?
Double encoding happens when a string is URL-encoded twice, so you see sequences like %253C (the % itself was encoded as %25). Decode it once to get %3C, then decode the result again to recover the original character.
Does a plus sign decode to a space?
It depends on the source. In application/x-www-form-urlencoded data, + means a space. In a standard URL path or generic percent-encoding, + is a literal plus and a space is written as %20. Check how the string was produced if you are unsure.
Can I decode the output back into encoded XML?
Not with this tool, which only decodes. To go the other direction, use a corresponding XML URL encode or escape tool to convert characters back into percent-sequences or entities.
Is it safe to decode XML that contains private data or tokens?
With this tool, decoding happens entirely in your browser and the input is never uploaded, so the data stays on your device. As with any sensitive value, avoid pasting it into tools that send data to a remote server.
Why is my decoded XML still not valid?
URL decoding only restores characters; it does not check structure. Decoded markup can still be malformed or contain XML entities that need separate unescaping. Run the result through an XML validator or formatter to confirm it is well-formed.
Related tools