Strict decoding is a sequence of explicit checks. The source must be ASCII, every percent sign must own two hexadecimal digits, and the resulting byte stream must decode as UTF-8 without replacement. Only after those checks does URLCodec re-encode the text to show whether the source spelling was canonical.
Broken escapes fail at the percent sign
A trailing %, a one-digit escape such as %2, or non-hex input such as %GG fails with the first relevant position. The tool does not drop the percent sign, pad a digit, or preserve the malformed fragment as ordinary text. Editable input remains available while stale success output disappears.
One pass prevents hidden recursive meaning
The input %252F represents the text %2F after one decoding pass. URLCodec stops there; it does not decode the new-looking escape into a slash. This makes every click reproducible and avoids changing meaning by an undocumented number of passes. Run another explicit decode only when the receiving workflow truly requires it.
Check the receiving component
Percent-encoding is contextual. URLCodec deliberately transforms one scalar value and does not parse a complete URL, split query pairs, normalize a path, validate a destination, or decide whether another system expects form rules. Copy the result only into the component whose contract you checked. Encoding changes representation; it does not encrypt, authenticate, sanitize, or make a destination safe.