FAQ

Common questions about Malicious URL Decoder.

What is URL‑encoded malicious payload?

Attackers often encode URLs using percent‑encoding (e.g., %20 for space) to hide malicious strings. This decoder converts those percent‑encoded sequences back to readable plain text, making it easier to analyze exploit payloads.

Does this tool decode only URLs or other encoded strings too?

It decodes any percent‑encoded string, not just URLs. You can paste obfuscated payload snippets, base64‑looking strings (if URL‑encoded), or command lines that are percent‑encoded and it will decode them to plain text.

Can I decode double‑encoded payloads?

This tool performs one layer of URL decoding. For double‑encoded payloads, simply run the output through the decoder again until no percent signs remain.

Is my submitted data stored on a server?

No. All decoding is done locally in your browser. Nothing is uploaded or stored, ensuring your investigation data remains private and secure.