Turn %3C back into readable markup
An XML payload copied from a query string can look like %3Cnote%3E from beginning to end. Paste it above. Auto mode detects the encoded opening tag, decodes one URL layer, checks the XML, and adds readable indentation.
Plain XML works in the same box. If the input already begins with <, Auto skips URL decoding and formats it directly.
- Paste URL-encoded or plain XML.
- Keep Auto selected for most inputs.
- Check the status above the result, then copy or download
decoded.xml.
The work happens in the current browser tab. No account. No server-side XML parser.
Auto, recursive, or format only
The three modes answer different problems.
| Mode | Use it when | Behavior |
|---|---|---|
| Auto | The input may be encoded once or may already be XML | Decodes one layer only when an encoded opening tag is detected |
| Recursive | One pass still leaves %3Croot%3E | Decodes up to five URL-encoding layers |
| Format only | Percent signs inside the XML must stay untouched | Skips URL decoding and only formats the markup |
Auto deliberately ignores %20 inside normal XML such as <path>save%20this</path>. A general URL decoder might change that text. Here, the tool looks for an encoded XML opening bracket before it decodes anything.
Decoded XML example
This input uses URL encoding plus the form-style + character for a space.
%3Cnote%3E%3Cto%3EAna%3C%2Fto%3E%3Cbody%3EHello+world%3C%2Fbody%3E%3C%2Fnote%3E
Auto mode produces:
<note>
<to>Ana</to>
<body>Hello world</body>
</note>
During the August 11, 2026 hands-on check, the tool reported one URL layer, valid XML, and four formatted lines. The copy action returned the same visible XML.
Decode XML that was encoded twice
Double encoding usually exposes %25. The first pass turns %253C into %3C; the second turns %3C into <.
Select Recursive for this input:
%253Croot%253Eok%253C%252Froot%253E
The result is <root>ok</root>, and the status reports two decoded layers. Recursive mode stops after five passes even when suspicious encoded text remains. That cap prevents an accidental loop and keeps the outcome reviewable.
When a plus sign means a space
HTML form encoding commonly writes a space as +. Keep Treat + as a space on for query-string or form data.
Turn it off when the XML contains a literal plus sign. For example, C%2B%2B safely decodes to C++ either way because its plus signs were encoded as %2B. Raw C++ is the case that changes when the option is on.
The distinction comes from URL-encoded form processing. MDN documents the behavior of decodeURIComponent(), while the WHATWG URL Standard defines the form encoding rules.
XML formatting and validation
Choose two spaces, four spaces, or a tab from the Indent menu. Formatting changes whitespace around elements. Tag names, attributes, and text content remain in the same order.
A malformed percent escape stops URL decoding. %E0%A4%A, for instance, is incomplete and cannot be decoded as a valid UTF-8 component.
Malformed XML produces a validation error beneath the result header. The decoded text remains visible when URL decoding succeeded, which is handy for finding the broken tag instead of starting over with the encoded string.
Common failures include:
- An
&that should have been written as&. <item>closes with</items>.- A quote is missing from an attribute.
- More than one top-level root element.
The XML specification is the primary reference for well-formed markup. For a structural conversion after the XML is clean, send it to the XML to JSON converter.
File support and limits
| Detail | Current behavior |
|---|---|
| Input | Pasted text or .xml and .txt files |
| Limit | 10,000,000 characters or a file up to 10 MB |
| URL decoding | UTF-8 percent encoding, one or up to five layers |
| Formatting | 2 spaces, 4 spaces, or tabs |
| Output | Copyable text and a UTF-8 decoded.xml download |
The tool reads text files. It does not fetch remote XML from a URL, expand external entities, run XSLT, or validate against a DTD or XSD schema.
Privacy and cautious XML handling
URL decoding, validation, and formatting run locally. The pasted payload and downloaded XML are not sent to Textavia for processing.
Local processing also avoids fetching external entities. Still, decoded XML can contain secrets, session identifiers, private endpoints, or customer records. Review the destination before copying the result into an issue tracker or public chat.
Related developer tools
- Decode an ordinary URL or query parameter with the URL Encoder/Decoder.
- Convert structured markup using XML to JSON.
- Inspect a token payload with the JWT Decoder.
- Clean JSON beside XML using the JSON Formatter.
- Remove transport encoding with the Base64 tools.