Why URLs Need Encoding
A URL may only contain a limited set of ASCII characters, and some of them have special meaning: / separates path segments, ? starts the query string, & separates parameters and # starts the fragment. Any other character — or a special character used as plain data — must be percent-encoded.
Decode or encode any string with our URL Encode / Decode tool.
How Percent-Encoding Works
A character is converted to its bytes in UTF-8, and each byte is written as % followed by two hexadecimal digits.
| Character | Encoded |
|---|---|
| space | %20 (or + in form data) |
& | %26 |
? | %3F |
/ | %2F |
é | %C3%A9 (two UTF-8 bytes) |
%20 or +?
Both appear for spaces. %20 is valid everywhere in a URL. + means a space only in query strings sent by HTML forms (the application/x-www-form-urlencoded format). In a path, + is a literal plus sign. When in doubt, use %20.
Non-English Characters and Domains
Paths and query values with characters like ü, ç or ş are encoded as UTF-8 bytes, as shown above. Browsers display them decoded for readability but send them encoded. Domain names are different: international domain names are converted to Punycode, which starts with xn--.
Common Mistakes
- Double encoding: encoding an already encoded string turns
%20into%2520. Decode the result to check. - Not encoding parameter values: a value containing
&splits into two parameters. Always encode values individually, not the whole URL. - Encoding the whole URL: encoding the
://and slashes breaks the link. Only encode the parts that are data. - Mixing encodings: legacy systems sometimes used Latin-1 instead of UTF-8, producing different codes for the same character.
In Code
- JavaScript:
encodeURIComponent()for parameter values;encodeURI()for a complete URL. - C#:
Uri.EscapeDataString(). - Python:
urllib.parse.quote()andurlencode().