XML URL Decoder — Free Online Tool

XML URL Decoder

Paste a URL-encoded XML string — from a query parameter, a server log or a redirect URL — and get readable XML back. Decoding runs in your browser; nothing is uploaded.

How the decoding works

The tool applies JavaScript's decodeURIComponent():

Every %XX escape is turned back into its character, and multi-byte UTF-8 sequences (accented letters, emoji) are reassembled.
Line breaks and indentation return from %0A and %20.
+ stays a plus sign. In HTML form encoding (application/x-www-form-urlencoded) a + means a space, but decodeURIComponent() does not treat it that way. If your input came from a form post, replace + with %20 first.
A broken escape stops decoding — a lone %, or % followed by non-hex characters, reports a "URI malformed" error instead of guessing.

Example

%3Cuser%20id%3D%227%22%3E%0A%20%20%3Cname%3EAda%20%26amp%3B%20Co%3C%2Fname%3E%0A%3C%2Fuser%3E

becomes

<user id="7">
  <name>Ada &amp; Co</name>
</user>

When you need it

Reading logs — web server and proxy logs record query strings encoded; decode a parameter to see the XML that was sent.
Debugging integrations that pass XML in URLs or form fields.
Inspecting redirect URLs from payment, SSO or partner systems.

After decoding

Run the result through the XML Formatter to indent a one-line document.
Check it with the XML Validator if the receiving system rejects it.
Text that still contains %XX sequences after one pass was encoded twice — decode it again.
SAML SAMLRequest parameters are also deflated and Base64-encoded, so URL-decoding alone produces Base64 text, not XML.