curl_unescape(3) Library Functions Manual curl_unescape(3)

curl_unescape - URL decode a string

#include <curl/curl.h>
char *curl_unescape(const char *input, int length);

Deprecated. Use curl_easy_unescape(3) instead.

This function converts the URL encoded string input to a "plain string" and return that as a new allocated string. All input characters that are URL encoded (%XX where XX is a two-digit hexadecimal number) are converted to their plain text versions. Although not constrained by its type, the returned data may not be altered.

If the length argument is set to 0, curl_unescape(3) calls strlen() on input to find out the size.

You must curl_free(3) the returned string when you are done with it.

This functionality affects all supported protocols

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    char *decoded = curl_unescape("%63%75%72%6c", 12);
    if(decoded) {
      /* do not assume printf() works on the decoded data */
      printf("Decoded: ");
      /* ... */
      curl_free(decoded);
    }
  }
}

Since 7.15.4, curl_easy_unescape(3) should be used. This function might be removed in a future release.

Added in curl 7.1

A pointer to a null-terminated string or NULL if it failed.

RFC2396, curl_easy_escape(3), curl_easy_unescape(3), curl_free(3)

2026-01-07 libcurl