Every URL you’ve ever shared contains encoded characters. That %20 in a search query is URL encoding at work. Here’s how it all fits together.

What Is URL Encoding?

URLs have a constrained character set: ASCII letters, digits, hyphens, underscores, tildes, and periods. Nearly everything else needs to be percent-encoded — converted into a % followed by two hexadecimal digits representing the byte value.

A space character (ASCII 32) becomes %20. The / character (ASCII 47) becomes %2F.

Why URLs Need Encoding

URLs were designed to transport text. Characters like spaces, &, ?, #, and non-ASCII text can break URL parsing:

  • ? marks the start of a query string
  • # marks a fragment identifier
  • & separates query parameters
  • Spaces are ambiguous — they could be interpreted as separators or literal spaces

Encoding resolves these ambiguities.

The Most Common Encoded Characters

| Character | Encoded | Reason | |-----------|---------|--------| | Space | %20 | Not in URL character set | | ! | %21 | Reserved in some contexts | | # | %23 | Fragment delimiter | | & | %26 | Query parameter separator | | ? | %3F | Query string start | | / | %2F | Path separator (in path only) | | : | %3A | Scheme delimiter | | @ | %40 | Userinfo delimiter | | = | %3D | Key-value assignment | | + | %2B | Space in query strings (special case) |

URL Encoding vs URL Decoding

Encoding converts unsafe characters to their percent-encoded form:

Search: hello world
Encoded: hello%20world

Decoding converts percent-encoded sequences back to their original characters:

Encoded: hello%20world
Decoded: hello world

A URL decoder reverses what a URL encoder does.

Real-World Example

A search for “café & pastries” in a query parameter:

https://example.com/search?q=caf%C3%A9%20%26%20pastries

Breaking it down:

  • caf%C3%A9 — “café” in UTF-8 (multi-byte characters encoded per byte)
  • %20 — space
  • %26 — the & symbol (encoded so it doesn’t break the query)

When to Encode URL Path vs Query Parameters

Path segments — encode everything except unreserved characters (A–Z a–z 0–9 - _ . ~):

/products/blue%20widgets

Query parameters — encode before building the query string, then & and = are encoded differently:

?category=blue%20widgets&sort=price

Query values — + is treated as a space in query values (legacy behavior from application/x-www-form-urlencoded), though %20 is more explicit.

Common Mistakes

Forgetting to Encode the Whole URL

If you build a URL by concatenating strings, some parts may need encoding while others don’t. Encode individual values, not the whole URL.

Double Encoding

Encoding already-encoded text creates a double-encoded URL that points to the wrong resource:

Already encoded: hello%20world
Double-encoded:  hello%2520world  ← wrong

Using + for Space in Path Segments

+ is only a space substitute in query string values, not in URL paths. Use %20 in paths.

Summary

URL encoding converts unsafe ASCII characters into %XX percent-encoded form. URLs need encoding because their character set is restricted. Decode to read encoded URLs. Never use encoding as security — it’s not.

Encode and decode any URL instantly with the URL Encoder/Decoder.