What Is URL Encoding? A Guide to Percent-Encoding in Web Addresses

Why URL Encoding Exists

URLs were originally designed to contain only a limited set of characters from the ASCII repertoire. However, the modern web needs to transmit data that includes spaces, accented characters, emojis, and symbols that have no place in a raw URL. URL encoding solves this problem by replacing unsafe characters with a % followed by two hexadecimal digits.

How Percent-Encoding Works

Each character that needs encoding is converted to its byte value (in UTF-8 for most modern systems) and represented as %XX, where XX is the hexadecimal value. For example:

• A space becomes %20
• An ampersand & becomes %26
• The euro sign € becomes %E2%82%AC (three bytes in UTF-8)
• A forward slash / becomes %2F

Some characters are always safe and never need encoding: letters (A-Z, a-z), digits (0-9), and a few special characters like -, _, ., and ~.

Reserved vs Unreserved Characters

RFC 3986 defines two categories:

• Unreserved characters: Letters, digits, -, _, ., ~ — these never need encoding.
• Reserved characters: :, /, ?, #, [, ], @, !, $, &, ', (, ), *, +, ,, ;, = — these have structural meaning in URLs and must be encoded when used as data rather than delimiters.

When You Must Encode URLs

Common scenarios that require URL encoding:

• Query parameters: Values in ?key=value pairs must be encoded to handle spaces and special characters.
• Path segments: File names or slugs containing non-ASCII characters need encoding.
• Form submissions: HTML forms with application/x-www-form-urlencoded use a slightly different encoding where spaces become +.
• Redirects: Server-side redirects with user-generated content in the URL.

Common Pitfalls

• Double encoding: Encoding an already-encoded URL produces %25 sequences that break the original data.
• Encoding the entire URL: You should encode individual components (path, query values), not the whole URL including :// and ?.
• Plus sign confusion: In query strings, + represents a space in application/x-www-form-urlencoded, but a literal + in the URL path.