URL Encoding Explained: When & Why to Encode URLs

What is URL Encoding?

URL encoding, also called percent-encoding, is the mechanism for representing characters in a URL that would otherwise have special meaning or are not allowed. When you see %20 in a URL, that is a URL-encoded space character. %26 is an ampersand. %3F is a question mark.

The process is simple: take the character's byte value in UTF-8, express each byte as two hexadecimal digits, and prefix each with a percent sign. The space character (UTF-8 byte 0x20) becomes %20. The euro sign (UTF-8 bytes 0xE2 0x82 0xAC) becomes %E2%82%AC.

This mechanism is defined in RFC 3986 and is fundamental to how the web works. Every time you click a link with special characters, URL encoding is happening behind the scenes.

Why URL Encoding is Necessary

URLs have a strict syntax. Certain characters have reserved meanings:

• ? separates the path from the query string
• & separates query parameters
• = separates parameter names from values
• # marks the fragment identifier
• / separates path segments
• : separates the scheme from the rest

If your data contains these characters, the browser or server cannot tell whether they are part of the URL structure or part of the data. URL encoding resolves this ambiguity by replacing data characters with their percent-encoded equivalents.

For example, searching for "cats & dogs" as a query parameter: ?q=cats%20%26%20dogs. Without encoding the ampersand, the server would interpret "dogs" as the start of a new parameter.

Non-ASCII characters (accented letters, CJK characters, emoji) must also be encoded because the URL specification only allows a limited set of ASCII characters.

Which Characters Need Encoding?

The URL specification defines three categories:

Unreserved Characters (Never Encode)

These are safe to use in any part of a URL without encoding:

A-Z a-z 0-9 - _ . ~

Reserved Characters (Encode When Used as Data)

These have special meaning in URLs. Encode them only when they appear as part of data, not as URL structure:

: / ? # [ ] @ ! $ & ' ( ) * + , ; =

Everything Else (Always Encode)

Spaces, non-ASCII characters, and control characters must always be encoded.

Use our URL Encoder/Decoder to quickly encode or decode any string.

URL Encoding in Programming Languages

Every major language provides built-in functions for URL encoding. Here are the most common:

JavaScript

encodeURIComponent("hello world & more") returns hello%20world%20%26%20more

Use encodeURIComponent() for encoding values to be placed in query parameters. Use encodeURI() for encoding a complete URL (it preserves structural characters like / and ?).

Python

from urllib.parse import quote
quote("hello world & more") returns hello%20world%20%26%20more

PHP

urlencode("hello world & more") returns hello+world+%26+more

Note: PHP's urlencode() uses + for spaces (the application/x-www-form-urlencoded convention), while rawurlencode() uses %20 (the RFC 3986 convention).

Java

URLEncoder.encode("hello world & more", "UTF-8") returns hello+world+%26+more

Like PHP, Java uses the form encoding convention with + for spaces by default.

Common URL Encoding Pitfalls

• Double encoding: Encoding an already-encoded string turns %20 into %2520 (the percent sign itself gets encoded). This is the most common encoding bug. Check whether your data is already encoded before applying encoding.
• Not encoding enough: Forgetting to encode user input in URL parameters creates broken links and security vulnerabilities (open redirect attacks, parameter injection).
• Space encoding confusion: %20 and + both represent spaces, but in different contexts. %20 is correct in URL paths. + is correct in form-encoded query strings. Mixing them up causes subtle bugs.
• Encoding the entire URL: Only encode the variable parts (parameter values, path segments with user data). Do not encode the structural parts (scheme, slashes, question marks).
• Ignoring character encoding: URL encoding operates on bytes, not characters. The character "e with accent" has different byte representations in UTF-8 vs Latin-1. Always use UTF-8 — it is the modern standard and what browsers expect.

Practical Examples

Here are real-world scenarios where URL encoding matters:

• Search queries: https://example.com/search?q=C%2B%2B%20programming — the plus signs in "C++" must be encoded as %2B to avoid being interpreted as spaces.
• File paths with spaces: https://example.com/files/my%20document.pdf — the space in the filename must be encoded.
• International domain names: URLs with non-ASCII characters in the path use percent-encoding: https://example.com/caf%C3%A9 for "cafe" with an accent.
• API parameters with JSON: ?data=%7B%22name%22%3A%22test%22%7D — curly braces, quotes, and colons all need encoding when passed as parameter values.
• Callback URLs: When passing a URL as a parameter value: ?redirect=https%3A%2F%2Fexample.com%2Fpage — the entire callback URL must be encoded.

Test your URL encoding with our URL Encoder/Decoder. For related developer tools, check out our guide on Base64 encoding and our JSON formatting guide.