URL decoder and encoder
Percent-decode and encode URL components, including double-encoded payloads and `+`-as-space form encoding.
Open in ctfpalPercent-encoding replaces bytes that would otherwise be structural in a URL with % followed by two hex digits. In web challenges it matters in both directions: you decode it to read what a parameter actually contained, and you encode payloads so they survive the trip to the server intact.
Double encoding is an attack, not an accident
%252e%252e%252f decodes once to %2e%2e%2f and twice to ../. When a filter inspects the request before the server decodes it a second time, that gap is the vulnerability. Any time a payload looks percent-encoded after you decode it, decode again and note which layer the filter was reading.
| Layer | Value | What sees it |
|---|---|---|
| As sent | %252e%252e%252f | The WAF or path filter |
| After one decode | %2e%2e%2f | The routing layer |
| After two decodes | ../ | The filesystem |
Worked example
Double-encoded traversal
Input
%252e%252e%252fetc%252fpasswdResult
%2e%2e%2fetc%2fpasswd (decode again for ../etc/passwd)One decode is not enough - the still-encoded result is the tell.
Load this example in the workspaceRelated tools
HTML entity decoder
Decode named, decimal, and hexadecimal HTML entities back to text - including the mixed-form entities used to slip past XSS filters.
Web attack payload catalog
Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.
HTTP request replayer
Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.
Base64 decoder and encoder
Decode and encode Base64 and Base64-URL in the browser, with padding repair and automatic detection of nested encodings. Nothing is uploaded.