URL Encoding Explained: When and How to Per...

URLs can only contain a limited set of characters, so anything outside that set has to be percent-encoded. Get it wrong and links break or query parameters get misread. Here's what you need to know.

What percent-encoding is

URL encoding replaces unsafe characters with a % followed by two hex digits representing the byte. A space becomes %20, a / becomes %2F, and so on. This lets arbitrary text — including spaces, symbols, and non-ASCII characters — travel safely inside a URL.

Which characters need encoding

Reserved characters that have special meaning in a URL — ? # & = / : — must be encoded when they appear as data rather than structure.
Unsafe characters like spaces, quotes, <, >, and most punctuation.
Non-ASCII characters (accents, emoji, other scripts) are encoded as their UTF-8 bytes.

Unreserved characters — letters, digits, -, _, ., ~ — never need encoding.

The space and plus-sign gotcha

Spaces are the classic trap. In a URL path, a space is %20. In a query string (application/x-www-form-urlencoded), a space is often written as +. Mixing these up is a common source of bugs — when in doubt, %20 is safe everywhere.

Encode components, not whole URLs

Encode each component (a single query value, a path segment) individually, then assemble the URL. Encoding an entire finished URL at once will mangle the ://, ?, and & that give it structure.

Part of the Encoding vs Encryption vs Hashing guide. See also Character Encoding: ASCII, Unicode & UTF-8, which explains the UTF-8 bytes percent-encoding escapes.

Try it

Paste a string to percent-encode it, or a URL-encoded string to decode it — safe for both full URLs and individual query components, all in your browser.

URL Encoding Explained: When and How to Percent-Encode