Why URL Decoding Reports a Malformed Percent Sequence

A URL decoder can reject an input even when every percent sign is followed by two hexadecimal digits. The triplets must also represent a character sequence that the chosen decoder understands. Separate a broken escape from a literal percent sign or an encoding mismatch before editing the text.

This procedure uses small invented values in the URL Encoder and Decoder. It investigates conversion errors; it does not test a destination website or recover missing source characters automatically.

Reproduce the failure with one encoded value

1. Save the original failing text separately.
2. Select Decode under Mode and Component (encodeURIComponent) under Encoding type.
3. Leave Treat + as a space (form style) unchecked.
4. Enter caf%E9 in Input and select Convert.

The current tool shows a message beginning Malformed percent sequence. and leaves the decoded output empty. Its general message explains the two-hexadecimal-digit rule, but that is only one possible cause. Here, E9 already consists of two hexadecimal digits.

Use the smallest failing component for diagnosis. Decoding an entire address as one component can also turn encoded data into URL separators; our query-value encoding guide explains that separate structural issue.

Check both escape spelling and UTF-8 validity

RFC 3986 defines a percent-encoded octet as a percent sign followed by two hexadecimal digits. One octet is not necessarily one complete text character.

The component decoder used here is JavaScript decodeURIComponent. Its MDN reference identifies two error conditions: a malformed percent triplet, or escaped bytes that do not encode a valid UTF-8 character.

Run each sample with the same settings. They produce the same general tool error, despite having different causes. Adding arbitrary digits or changing letter case is not a reliable repair. MDN also documents the broader malformed URI exception; an exception reports a failed conversion, not the intended replacement text.

Rebuild from authoritative text when it is available

For this exercise, suppose the original value is known to be café, with a single precomposed é. Select Encode, keep Component selected and form-style handling off, then convert that original text. The output is:

caf%C3%A9

Now select Decode, enter that encoded result and convert it once. The result is café. Compare the accent and the complete value with the authoritative original.

The successful UTF-8 form uses %C3%A9 for this character. That does not prove an unfamiliar %E9 was intended to mean the same thing. If the original is unavailable, investigate the producer, expected character encoding and any copy or truncation step. This tool has no control for decoding a different legacy character encoding.

Handle a literal percent sign as data

If the intended text is a percentage such as 25%, it starts as raw text. Use Encode with Component rules to obtain:

25%25

Decoding that result once returns 25%. RFC 3986 describes %25 as the representation needed when a percent octet is data within the URI.

Do not replace every percent sign in a failing value with %25. Changing caf%E9 to caf%25E9 lets one decode return the literal text caf%E9; it does not recover café. A successful conversion can still represent the wrong value.

Fix the producing step and verify the result

1. Record the original input, conversion settings and the smallest failing portion.
2. Determine whether that portion is raw text, an encoded component or a damaged copy. Do not infer its state merely from the presence of a percent sign.
3. Correct the step that generates or copies the value, using its documented encoding and the authoritative source text.
4. Convert once in the appropriate direction and compare the entire resulting value with the original.
5. For a real link, rebuild its structure around the corrected component, open it and verify the intended destination or application result.

Keep the failing sample as a regression check. Repeatedly decoding until an error disappears cannot establish what the source meant, and a converter success message cannot confirm that a real resource exists.