URL Encoding Explained: Percent-Encoding and When You Need It

Copy a URL with a search term in it and you'll often see something like %20 or %C3%A9 where a space or an accented letter should be. That's URL encoding at work. This guide explains what it does, why it's needed, and which characters get escaped.

What URL encoding is

URL encoding — also called percent-encoding — is a way to represent characters in a URL that would otherwise be unsafe or ambiguous. Each such character is replaced by a % followed by its byte value in hexadecimal. A space becomes %20; an ampersand becomes %26.

Why it's needed

URLs can only contain a limited set of characters, and some of those have special jobs: ? starts the query string, & separates parameters, / separates path segments, and # marks a fragment. If a value you're putting into a URL contains one of these, it has to be encoded so it's treated as data, not structure.

Search term:  cats & dogs
In a URL:     ?q=cats%20%26%20dogs

Without encoding, the raw & would be read as the start of a new parameter, and the search would break.

Reserved vs. unreserved characters

• Unreserved characters — letters, digits, and - _ . ~ — are always safe and never need encoding.
• Reserved characters — like ? & / # : @ = — have special meaning and must be encoded when used as literal data.
• Everything else — spaces, accented letters, emoji, and most symbols — is encoded based on its UTF-8 bytes, which is why one character can become several %xx pairs.

A common confusion: the plus sign

In the query string of a form submission, spaces are sometimes encoded as + rather than %20. Both can mean “space” depending on context, which trips people up — when in doubt, %20 is always safe.

URL encoding vs. Base64

These solve different problems. URL encoding makes text safe to place inside a URL; Base64 makes binary data safe to move through text-based channels. They're sometimes combined (Base64URL) but aren't interchangeable.

To encode or decode a value, use the URL encoder, and to pull apart all the parameters in a query string, the query string parser breaks them into a readable list.