YAML URL Decode

How to use the YAML URL Decode

Type or paste into the URL encoded box, or click Sample. You can also drop a text file on either box, or load one into the URL encoded box with its Open file button.

The YAML box updates live as you type. It works both ways — edit the YAML side to convert back, or click ⇄ Swap to exchange the sides.

Use Copy or Download on either box to take the result, or Clear to start again.

YAML URL decode for shared links

When YAML travels in a URL, its structure turns into a long run of %0A and %20 sequences. The YAML URL decode tool reverses the percent-encoding and shows the result with YAML highlighting, so the nesting of keys and lists is visible again.

Example

Encoded input:

service%3A%20api%0Aports%3A%0A%20%20-%208080%0Alabel%3A%20%22a%20%26%20b%22

Decoded YAML:

service: api
ports:
  - 8080
label: "a & b"

The two-space indentation under ports is restored exactly, so the list item still belongs to the right key. That is the main thing that can go wrong with YAML in URLs: if any tool along the way trimmed or collapsed whitespace, the structure changes even though every character decodes correctly.

What to check after decoding

Indentation. YAML nesting depends on consistent spaces. If the decoded document looks flattened, the sender may have trimmed whitespace before encoding.
Plus signs. This tool keeps + as a literal plus. If the YAML came from an HTML form, spaces may have been sent as +; use the URL Decoder with “Decode + as space” instead.
Double encoding. Seeing %25 in the output means another layer of encoding. Run the result through the decoder once more.
Line endings. A document created on Windows may contain %0D%0A pairs; they decode to ordinary line breaks (the editor stores every line break as a single LF), which YAML parsers accept.

Worked example: a block scalar in a URL

Multi-line values survive URL encoding only if every space is kept. This parameter holds a CI step with a literal block:

script%3A%20%7C%0A%20%20npm%20ci%0A%20%20npm%20test

Decoded, it is:

script: |
  npm ci
  npm test

The | keeps each line break, so the value is two separate commands. With > instead, the lines would be folded into one: npm ci npm test. If a tool between sender and receiver dropped the %20%20 indentation, the commands would no longer belong to the block and the YAML would fail to parse, which is why checking the decoded indentation matters.

YAML surprises worth checking

Decoded YAML sometimes parses differently from what its author expected, especially with YAML 1.1 parsers:

Unquoted no, off or NO (the Norway country code) can become the boolean false.
Version numbers such as 1.10 are read as the float 1.1; quote them to keep them as strings.
Values starting with * or & are aliases and anchors, and # after a space starts a comment.

Before you use a decoded config

YAML from a link is input from someone else. Read it before applying it to a system, and be careful with loaders that can construct arbitrary objects from tags — for example, use yaml.safe_load rather than yaml.load in Python. To confirm the document parses, paste it into the YAML Validator; to see it as structured data, convert it with YAML to JSON.

The decoding is done in your browser, and the text you paste is not uploaded.

Frequently asked questions

Why does my decoded YAML fail to parse?

Common causes are lost indentation, tabs used for indentation, or a truncated URL. Also check whether the value was encoded twice.

Does it convert + to spaces?

No. Values encoded with encodeURIComponent use %20 for spaces, so + is kept. Use the URL Decoder with the + option for form-encoded data.

Can I decode just part of a URL?

Paste only the parameter value. The ? and & separators of the surrounding URL are not part of the YAML.

Is it safe to load YAML from a link?

Treat it like any untrusted input. Review it first and use a safe loader that does not instantiate arbitrary objects.