diff --git a/libavformat/httpauth.c b/libavformat/httpauth.c
index 2d42ab2190..54d0322c6a 100644
--- a/libavformat/httpauth.c
+++ b/libavformat/httpauth.c
@@ -255,7 +255,7 @@ char *ff_http_auth_create_response(HTTPAuthState *state, const char *auth,
 
     if (state->auth_type == HTTP_AUTH_BASIC) {
         int auth_b64_len, len;
-        char *ptr, *decoded_auth = ff_urldecode(auth);
+        char *ptr, *decoded_auth = ff_urldecode(auth, 1);
 
         if (!decoded_auth)
             return NULL;
@@ -275,7 +275,7 @@ char *ff_http_auth_create_response(HTTPAuthState *state, const char *auth,
         av_strlcat(ptr, "\r\n", len - (ptr - authstr));
         av_free(decoded_auth);
     } else if (state->auth_type == HTTP_AUTH_DIGEST) {
-        char *username = ff_urldecode(auth), *password;
+        char *username = ff_urldecode(auth, 1), *password;
 
         if (!username)
             return NULL;
diff --git a/libavformat/urldecode.c b/libavformat/urldecode.c
index 283d912671..5261bcd0cd 100644
--- a/libavformat/urldecode.c
+++ b/libavformat/urldecode.c
@@ -32,7 +32,7 @@
 #include "libavutil/avstring.h"
 #include "urldecode.h"
 
-char *ff_urldecode(const char *url)
+char *ff_urldecode(const char *url, int decode_plus_sign)
 {
     int s = 0, d = 0, url_len = 0;
     char c;
@@ -74,7 +74,7 @@ char *ff_urldecode(const char *url)
                 dest[d++] = c2;
                 dest[d++] = c3;
             }
-        } else if (c == '+') {
+        } else if (c == '+' && decode_plus_sign) {
             dest[d++] = ' ';
         } else {
             dest[d++] = c;
diff --git a/libavformat/urldecode.h b/libavformat/urldecode.h
index cb81ebc6f7..80b11c3428 100644
--- a/libavformat/urldecode.h
+++ b/libavformat/urldecode.h
@@ -26,10 +26,11 @@
  * in that case the original string is duplicated.
  *
  * @param url a string to be decoded.
+ * @param decode_plus_sign if nonzero plus sign is decoded to space
  * @return new string with the URL decoded or NULL if decoding failed.
  * Note that the returned string should be explicitly freed when not
  * used anymore.
  */
-char *ff_urldecode(const char *url);
+char *ff_urldecode(const char *url, int decode_plus_sign);
 
 #endif /* AVFORMAT_URLDECODE_H */