URL Encoding Explained (Percent-Encoding)

Why URLs need encoding

A URL uses certain characters for structure: ? starts the query, & separates parameters, / separates path segments, and a space is not allowed at all. If your data contains those characters, they would be misread. Encoding replaces them with a safe stand-in so the URL still parses correctly.

How percent-encoding works

Each unsafe character is replaced by a percent sign followed by its two-digit hexadecimal byte value. A space becomes %20, an ampersand becomes %26, a question mark becomes %3F. Letters, digits and a few safe symbols are left as they are. The URL Encoder/Decoder here converts both ways in your browser.

Encoding a whole URL vs one parameter

There is a key distinction. When encoding a single value to drop into a query parameter, encode everything unsafe including / and ? and & — because inside a value those are just data. When encoding a complete URL, you must leave the structural characters alone or you break the address. In JavaScript these are encodeURIComponent (for a value) and encodeURI (for a whole URL); using the wrong one is a classic bug.

Where it shows up

You see percent-encoding whenever a search term with spaces appears in an address bar, when a link carries a name or email as a parameter, or in redirect URLs that contain another URL inside them. Decoding it makes an intimidating link readable again.

Frequently asked questions

Why is a space sometimes + and sometimes %20? In the query string of older form submissions a space can be +; elsewhere it is %20. Both decode back to a space in the right context.

Do I need to encode letters and numbers? No — plain letters, digits and a handful of safe symbols pass through unchanged.

What breaks if I skip encoding? Special characters get misread, cutting your value short or corrupting the request.