Fixing "Malformed URI Sequence" Errors in decodeURIComponent

"URIError: URI malformed" from decodeURIComponent() means the string you passed in contains a percent sign followed by something that isn't a valid two-digit hexadecimal sequence — decodeURIComponent expects every % it encounters to be followed by exactly two hex digits representing an encoded byte, and anything else causes it to throw rather than guess at what you meant.

The most common cause is a raw, literal % character in the string that was never meant to be part of URI encoding at all — for example, decoding a string that contains a percentage value like '50% off' where that % wasn't supposed to be treated as the start of an encoded sequence. If the string wasn't actually produced by encodeURIComponent() in the first place, decoding it is the wrong operation entirely.

Double-decoding causes a related but distinct failure. If a string was encoded once but decoded twice — once automatically by a framework or server, and again manually in your own code — the second decode attempt operates on a string that's already back to its original, non-encoded form, and any literal % characters in that original text trigger exactly this error on the second pass.

Truncated strings cause it too — if a URI-encoded string gets cut off partway through a %XX sequence, for example by a length limit or a network interruption, decodeURIComponent finds a % with no complete two-digit sequence following it and has no valid way to interpret it.

To debug this reliably, log the exact string right before the decode call and look specifically for any % character not immediately followed by two hex digits (0-9, A-F) — that's your malformed sequence, and its surrounding context usually tells you whether the string was double-encoded, truncated, or simply never meant to be decoded as a URI component in the first place.

If you're building a pipeline that encodes and decodes URL components and want to confirm a specific value round-trips correctly, our URL Encoder lets you encode and decode strings interactively, which is a fast way to check whether a given string decodes cleanly before you trust that logic inside your actual application code.