EncodingRuns locallyNo account

URL decoder and encoder

Percent-decode and encode URL components, including double-encoded payloads and `+`-as-space form encoding.

Percent-encoding replaces bytes that would otherwise be structural in a URL with % followed by two hex digits. In web challenges it matters in both directions: you decode it to read what a parameter actually contained, and you encode payloads so they survive the trip to the server intact.

Double encoding is an attack, not an accident

%252e%252e%252f decodes once to %2e%2e%2f and twice to ../. When a filter inspects the request before the server decodes it a second time, that gap is the vulnerability. Any time a payload looks percent-encoded after you decode it, decode again and note which layer the filter was reading.

Layer	Value	What sees it
As sent	`%252e%252e%252f`	The WAF or path filter
After one decode	`%2e%2e%2f`	The routing layer
After two decodes	`../`	The filesystem

A traversal that survives a filter by being decoded one time too many.

Worked example

Double-encoded traversal

Input

%252e%252e%252fetc%252fpasswd

Result

%2e%2e%2fetc%2fpasswd  (decode again for ../etc/passwd)

One decode is not enough - the still-encoded result is the tell.

Load this example in the workspace