What Is URL Encoding (Percent-Encoding)?
3 min readUpdated June 7, 2026
URL encoding, also called percent-encoding, is a way of representing characters in a web address that would otherwise be unsafe or have a special meaning. Any such character is replaced by a percent sign followed by two hexadecimal digits — its byte value. The classic example is a space, which becomes %20. So the text 'hello world' inside a URL turns into 'hello%20world'.
URLs were designed to travel through many different systems — browsers, servers, proxies, logs — using only a small, safe set of characters. Percent-encoding is the escape hatch that lets you put anything else into a URL without breaking it. This guide explains what URL encoding is, why it exists, which characters need it, and how the two common JavaScript helpers differ.
Why URLs need encoding
A URL can only safely contain a limited set of characters: letters, digits, and a handful of symbols. Everything else has to be encoded. Some characters are unsafe because they get mangled in transit — a space, for example, can be dropped or misread, so it is encoded as %20. Other characters are 'reserved': they have a structural job inside a URL, like separating parts of it.
Think about a query string such as ?q=cats & dogs. The ampersand (&) is what separates one query parameter from the next, and the question mark (?) marks where the query string begins. If a user's actual search text contains an & or a ?, you must encode it so the URL parser treats it as data, not structure. The same applies to /, which separates path segments, and to non-English (Unicode) characters, which are encoded as their UTF-8 bytes.
How percent-encoding works
Each character a URL cannot carry directly is converted to its byte value in the UTF-8 character set, then written as a percent sign plus two hexadecimal digits. A space is byte 32, which is 20 in hexadecimal, so it becomes %20. An ampersand is byte 38, which is 26 in hex, so & becomes %26. Characters outside basic ASCII, such as é or 中, become multiple bytes and therefore several percent-encoded pairs in a row.
Decoding simply reverses the process: every %HH sequence is read back as a byte and reassembled into the original text. Because the rules are fixed and reversible, any system can decode a URL without needing a secret or key — encoding changes only the representation, not the meaning.
Reserved vs. unreserved characters
Unreserved characters never need encoding: the letters A–Z and a–z, the digits 0–9, and the four symbols hyphen (-), underscore (_), period (.), and tilde (~). These are always safe to use as-is.
Reserved characters have special structural meaning in a URL — examples include : / ? # [ ] @ ! $ & ' ( ) * + , ; =. They are fine when used for their intended structural role, but must be encoded when they appear inside data, such as a search term or a parameter value. The distinction matters because encoding a reserved character at the wrong moment can break the URL's structure, while failing to encode it inside data can corrupt your value.
encodeURIComponent vs. encodeURI
JavaScript offers two built-in encoders for different jobs. Use encodeURIComponent when you are encoding a single piece of data — one query parameter value, one path segment. It encodes reserved characters like &, =, ?, and / so they cannot be mistaken for URL structure. Use encodeURI when you have a complete, already-structured URL and only want to fix unsafe characters like spaces; it deliberately leaves reserved characters such as / and ? alone so the URL stays intact.
A concrete example: encoding the search query 'cats & dogs?' with encodeURIComponent gives 'cats%20%26%20dogs%3F', which is safe to drop into ?q=cats%20%26%20dogs%3F. Running encodeURI on the whole URL 'https://example.com/search?q=cats & dogs' only turns the space into %20 and leaves the ? and / untouched. Choosing the right one is the difference between a URL that works and one that silently loses data.
Frequently asked questions
What does %20 mean in a URL?+
%20 is the percent-encoded form of a space character. Spaces are not allowed directly in URLs, so they are replaced with %20 (the byte value 32, written as 20 in hexadecimal).
Is URL encoding the same as encryption?+
No. URL encoding is a fixed, reversible transformation with no key or secret. Anyone can decode it instantly. It changes how characters are represented, not their confidentiality, so never use it to protect sensitive data.
When should I use encodeURIComponent instead of encodeURI?+
Use encodeURIComponent for a single value like one query parameter or path segment — it encodes reserved characters such as &, =, and /. Use encodeURI only on a full, already-structured URL when you just need to fix unsafe characters like spaces.
Which characters do not need to be URL encoded?+
The unreserved characters: letters A–Z and a–z, digits 0–9, and the symbols hyphen (-), underscore (_), period (.), and tilde (~). Everything else may need encoding depending on where it appears.
Why do special characters break query strings?+
Characters like &, ?, and = have structural meaning in a URL — & separates parameters and = assigns values. If they appear inside your data without encoding, the parser treats them as structure and your value gets split or lost.