URL Encoding Explained: A Complete Guide

Published on · 779 words

Want to follow along with this guide? Open the free URL encoder & decoder and try encoding URLs, parsing components, and editing query parameters interactively.

URL encoding is a fundamental mechanism that ensures data can be safely transmitted across the internet. When you type a web address with special characters, spaces, or non-ASCII text, URL encoding converts those characters into a format that browsers and servers can reliably parse. Without it, URLs with spaces, ampersands, or international characters would break or be misinterpreted.

This guide explains what URL encoding is, how percent-encoding works at the byte level, which characters are considered reserved in URLs, and when you need to apply encoding in your web development workflow. Whether you are building query strings, handling user input, or debugging API endpoints, understanding URL encoding is essential.

What Is URL Encoding?

URL encoding (formally known as percent-encoding) is a mechanism for encoding characters that are not allowed or are unsafe in a URL. It replaces each problematic character with a percent sign (%) followed by two hexadecimal digits that represent the character's UTF-8 byte value. For example, a space becomes %20, an ampersand becomes %26, and a non-ASCII character like é becomes %C3%A9.

The URL specification (RFC 3986) defines a set of characters that are allowed in URLs without encoding, including letters (A-Z, a-z), digits (0-9), and a few special characters called unreserved characters: hyphen (-), period (.), underscore (_), and tilde (~). Everything else must be percent-encoded to ensure safe transmission.

Reserved Characters and When Encoding Is Needed

URLs have a specific structure with reserved characters that serve as delimiters. The colon (:) separates the protocol, slashes (//) separate the host, question mark (?) starts the query string, hash (#) starts the fragment, and ampersand (&) separates query parameters. These characters must not appear unencoded in URL components where they would be misinterpreted.

  • User Input in Query Parameters: Any user-provided value placed in a query string must be encoded to prevent special characters from breaking the URL structure.
  • Spaces in URLs: Spaces are not allowed in URLs and must be encoded as %20 (or + in application/x-www-form-urlencoded format used in form submissions).
  • Non-ASCII Characters: International characters, emojis, and any character outside the ASCII range must be UTF-8 encoded and then percent-encoded.
  • Reserved Characters in Path Segments: Characters like / ? # [ ] @ in path segments must be encoded if they are part of the data rather than delimiters.
  • API Endpoints: When building REST API URLs with dynamic values, always encode path parameters and query values to prevent injection and parsing errors.

How Percent-Encoding Works at the Byte Level

Percent-encoding operates on the byte level, not the character level. First, the character is converted to its UTF-8 byte sequence. Then each byte is represented as a percent sign followed by two uppercase hexadecimal digits. ASCII characters that need encoding use a single byte (e.g., space = 0x20 → %20), while multi-byte UTF-8 characters produce multiple percent-encoded sequences.

For example, the euro sign (€) is encoded in UTF-8 as three bytes: 0xE2, 0x82, 0xAC. In a URL, it becomes %E2%82%AC. Similarly, the Chinese character 中 is encoded as three UTF-8 bytes: 0xE4, 0xB8, 0xAD, resulting in %E4%B8%AD. This byte-level approach ensures that any character from any language can be safely represented in a URL.

Frequently Asked Questions

What is URL encoding?▼
URL encoding (percent-encoding) replaces unsafe characters in a URL with a percent sign (%) followed by two hexadecimal digits. For example, a space becomes %20 and an ampersand becomes %26. This ensures URLs can be safely transmitted over the internet.
Which characters need to be encoded in URLs?▼
All characters except unreserved characters (A-Z, a-z, 0-9, hyphen, period, underscore, tilde) should be encoded. Reserved characters like :/?#[]@!$&'()*+,;= must be encoded when used as data rather than delimiters. Spaces, non-ASCII characters, and any special symbols always need encoding.
What is the difference between %20 and + for spaces?▼
%20 is the percent-encoded representation of a space in URLs (RFC 3986). The + sign represents a space only in the application/x-www-form-urlencoded format used for HTML form submissions and query strings. In URL paths, always use %20 for spaces.
Do I need to encode a URL that already has special characters?▼
It depends. If the special characters are part of the URL structure (like ://, ?, #, &), they should not be encoded. If they are part of the data values (like a search term with spaces or ampersands), they must be encoded. Use encodeURIComponent for values and encodeURI for complete URLs.
Can I decode a percent-encoded URL?▼
Yes. Decoding reverses the process by replacing each %XX sequence with the corresponding byte and reconstructing the original character. JavaScript provides decodeURIComponent() and decodeURI() for this purpose. Our free URL encoder tool supports both encoding and decoding.

Try it now — free, private, and instant

Encode or decode URLs, parse URL components, and edit query string parameters as an interactive table.

Launch the URL Encoder