What is URL Encoding? Percent-Encoding Explained

URL encoding, also called percent-encoding, is a method of converting characters that are unsafe or have special meaning in a URL into a format that can be safely transmitted. Each unsafe character is replaced with a percent sign (%) followed by two hexadecimal digits representing its byte value — for example, a space becomes %20.

What is URL encoding?

A URL can only contain a limited set of characters — letters, digits, and a handful of symbols. Anything outside that set, or any character that already has a structural meaning in a URL, has to be encoded so it is not misread. URL encoding is the agreed-upon way to do that: replace the character with % and its hexadecimal code.

So https://example.com/search?q=hello world becomes https://example.com/search?q=hello%20world. The space, which is not allowed in a URL, is safely represented as %20.

Why does URL encoding exist?

URLs were designed to be typed, printed, and transmitted across many different systems, so they must stick to a safe, universal character set. Two problems make encoding necessary:

• Unsafe characters like spaces, quotes, and non-English letters may be altered or rejected in transit.
• Reserved characters like ?, &, =, /, and # already have a job in a URL. If they appear inside a value, they must be encoded so they are not mistaken for structure.

Imagine a search for cats & dogs. Left alone, the & would look like the start of a new query parameter. Encoded as cats%20%26%20dogs, it is safely treated as part of the value.

How percent-encoding works

The mechanism is simple. Each character to be encoded is looked up as one or more bytes, and each byte is written as % plus its two-digit hexadecimal value. A few common examples:

Non-English characters are first converted to their UTF-8 bytes and then each byte is percent-encoded, which is why an accented letter can turn into two % codes.

Reserved vs unreserved characters

The URL standard splits characters into two groups. Unreserved characters — the letters A–Z and a–z, the digits 0–9, and - _ . ~ — never need encoding. Reserved characters have special meaning and are encoded whenever they appear inside a value rather than as structure. Everything else is encoded by default.

A crucial rule: encode parts, not the whole

The most common mistake is encoding an entire URL at once. If you do that, the :// and the slashes get encoded too, and the URL stops working. Instead, encode only the individual components — typically the values in a query string — so the structural characters keep their meaning.

For example, encode just the value hello world & more, then place the result into your query string. To take a query string apart and inspect each value, use a URL query parser.

Encoding vs decoding

The two operations are mirror images. Encoding prepares text for a URL by replacing unsafe characters with percent codes. Decoding reverses that on the receiving end, turning %20 back into a space so the original value is readable again. Servers decode incoming URLs automatically, but when you are debugging a link by hand, doing it yourself is invaluable.

Where you'll encounter URL encoding

URL encoding quietly does its job in many everyday situations:

• Search and query strings — any search term with a space or symbol is encoded.
• Form submissions — data sent via a GET form is percent-encoded into the URL.
• API requests — parameters passed in the URL must be encoded to stay valid.
• Redirects — a destination URL passed as a parameter is encoded so it survives intact.

Encoding in different languages

You rarely encode by hand in code — each language has a helper. In JavaScript, encodeURIComponent encodes a single value:

encodeURIComponent("hello world & more");
// "hello%20world%20%26%20more"

Python's standard library does the same with urllib:

from urllib.parse import quote
quote("hello world & more")
# 'hello%20world%20%26%20more'

Note that encodeURIComponent is for individual components; a separate function, encodeURI, is meant for a whole URL and leaves structural characters alone.

Form encoding and the + sign

When a browser submits an HTML form, it uses a variant called application/x-www-form-urlencoded. In this mode a space may be written as a + instead of %20, and both are understood as a space within a query string. Outside of form-encoded query strings, always use %20 — it is valid anywhere in a URL.

How to encode and decode URLs online

These free, browser-based tools process everything locally:

• URL Encoder — percent-encode text for safe use in a URL.
• URL Decoder — turn percent-encoded text back into readable characters.
• URL Query Parser — break a query string into readable key–value pairs.

Conclusion

URL encoding is the quiet mechanism that keeps links working when they carry spaces, symbols, and international text. Remember the essentials: unsafe and reserved characters become % plus a hex code, you encode components rather than whole URLs, and decoding simply reverses it. With those rules and a good encoder on hand, malformed links become a thing of the past.