XML URL decode: read encoded markup
Web server logs, proxy traces and browser developer tools show XML parameters in their encoded form: %3Corder%20id%3D%227%22%3E…. The XML URL decode tool percent-decodes the value and displays the result as XML, so you can read the request that was actually sent.
Example
Encoded input:
%3Corder%20id%3D%227%22%3E%3Citem%20qty%3D%222%22%3ETea%20%26amp%3B%20biscuits%3C%2Fitem%3E%3C%2Forder%3EDecoded XML:
<order id="7"><item qty="2">Tea & biscuits</item></order>Only the URL layer is removed. XML entities such as & stay in place, because they are part of the XML itself and an XML parser will decode them when it reads the document. If you want the entities decoded too, run the result through XML Unescape.
How decoding works
- Each
%XXsequence becomes the corresponding byte, and multi-byte UTF-8 sequences are combined into characters. - A
+is kept as a plus sign. If the XML was posted from an HTML form, spaces may appear as+; decode it with the URL Decoder and its “Decode + as space” option instead. - Invalid percent sequences are left as they are rather than stopping the whole decode.
Recognizing encoded XML at a glance
A handful of escape sequences make up most of an encoded XML value. Learning them lets you read a log line without decoding it:
| Encoded | Character | Encoded | Character |
|---|---|---|---|
%3C | < | %3E | > |
%2F | / | %3D | = |
%22 | " | %26 | & |
%20 | space | %0A | line feed |
So %3C%3Fxml is the start of an XML declaration, and %3C%2F marks a closing tag. A value starting with %253C has been encoded twice, because %25 is the percent sign itself.
Troubleshooting
- Output looks like random letters and digits. The value is probably Base64, as in SAML
SAMLResponseform posts. Decode it with Base64 to XML after URL decoding. - Garbled binary output. SAML redirect-binding requests are DEFLATE-compressed before Base64 encoding, so they need to be inflated as well.
- Still contains %3C. The XML was encoded twice. Decode again.
Decoding XML parameters in code
In PHP, rawurldecode keeps plus signs while urldecode turns them into spaces; in Java, URLDecoder.decode always converts + to a space. That matters for XML, because a literal plus inside element text or an attribute — a phone number such as +44 20 7946 0000, for example — is silently changed into a space if the sender did not encode it as %2B. If numbers or formulas look wrong after decoding, check how the plus sign was handled.
Next steps
Once decoded, you can copy the XML into a formatter or validator to check its structure, compare it with the payload your code intended to send, or extract a single element value for a bug report. Because the decoding happens in your browser, it is fine to use with internal integration payloads.