Why does decoding fail with "malformed percent-encoding"?
A % must be followed by exactly two hexadecimal digits. The error means the input contains something like %zz, a truncated %4, or a literal % that was never encoded — which is itself a common bug in URL-building code.
My URL is encoded twice. What do I do?
Run the decoder twice. Double encoding shows up as %253A (which decodes to %3A, then to :) and usually means a URL was passed through two layers that each encoded it. Decoding repeatedly until the output stops changing is safe.