When does XML end up percent-encoded inside a URL?
Three common situations. First, GET-style SOAP and legacy enterprise APIs that accept the full envelope as a query parameter. Second, redirect callback URLs that round-trip an XML state value (XACML, SAML LogoutRequest, certain WS-Federation flows). Third, application/x-www-form-urlencoded POST bodies where every byte of an XML payload is escaped to fit the form spec.
Why does my decoded XML have + signs that should be spaces?
The + character represents a space only inside application/x-www-form-urlencoded payloads — not in RFC 3986 query strings. This tool replaces every + with %20 before decoding so form-encoded values round-trip correctly. If your input came from a strict RFC 3986 source where + is meant literally, decode without the substitution by stripping the +-handling step in your own code.
Does this validate that the decoded result is well-formed XML?
No — the tool only reverses percent-encoding. After decoding, paste the result into the XML Validator or XML Formatter to confirm the document parses cleanly and has correct structure.
How do I extract just the XML from a full URL?
Identify the parameter that carries the XML (commonly named xml, payload, body, or saml). Copy the value after the equals sign and before the next ampersand. Paste only that segment — keys and delimiters in the input add literal text to the decoded output.
How are multi-byte UTF-8 sequences handled?
decodeURIComponent reads consecutive %XX bytes as a UTF-8 byte sequence and returns the corresponding code point. So %C3%A9 becomes é, %E2%82%AC becomes €, and %F0%9F%9A%80 becomes 🚀. If the input contains a malformed sequence — for example an isolated %C3 without its continuation byte — the function throws URIError and the tool surfaces the error.
Why do I see %26 in the input even though the data is XML?
XML uses & inside &, <, ", etc. When the entire XML is then percent-encoded for a URL, every & — including those inside entity references — becomes %26. After decoding, you will see & restored to its escaped form (&); this is correct because the underlying XML still contains the entity reference. Run XML Unescape next if you need the actual literal characters.
Is there a length limit?
The tool itself has no hard limit, but the URLs that carried the XML do. Most browsers and proxies cap URLs around 2,000–8,000 characters, so XML payloads larger than ~500 lines were almost certainly transported in a POST body, not a query string. If you have a long input, it likely came from a form body or a server log rather than a live URL.
Is my XML uploaded to a server?
No. decodeURIComponent runs in your browser. SOAP envelopes, SAML assertions, and any embedded credentials never leave the page. Verify in DevTools → Network — no request fires when you click Decode.