What is URL Encoding? A Complete Developer Guide

Every time you submit a search query, click a link with special characters, or build an API request in your code, URL encoding is silently doing its job behind the scenes. Yet many developers — even experienced ones — are fuzzy on exactly what URL encoding is, why it exists, and when they need to apply it manually. This guide covers everything you need to know.

The Problem: URLs Have a Limited Character Set

A URL (Uniform Resource Locator) is defined by RFC 3986, the Internet standard that specifies the syntax of URIs (Uniform Resource Identifiers). This specification allows only a restricted set of characters in a URL:

• Unreserved characters — safe to use anywhere: A–Z a–z 0–9 - _ . ~
• Reserved characters — have special structural meaning: : / ? # [ ] @ ! $ & ' ( ) * + , ; =
• Everything else — including spaces, accented letters, emoji, and most Unicode characters — is not permitted in a raw URL.

So what happens when you need to include a space in a URL? Or an ampersand that's part of a query value rather than a query separator? Or a Chinese character in a search query? That's where URL encoding comes in.

What is URL Encoding (Percent-Encoding)?

URL encoding, formally known as percent-encoding, is the mechanism by which unsafe or reserved characters are converted into a safe representation that can be transmitted in a URL without ambiguity.

The process is simple: each unsafe character is replaced by a percent sign (%) followed by the two-digit uppercase hexadecimal representation of its ASCII or UTF-8 byte value.

Space   →  %20  (or + in query strings)
!       →  %21
"       →  %22
#       →  %23
$       →  %24
%       →  %25
&       →  %26
'       →  %27
(       →  %28
)       →  %29
+       →  %2B
/       →  %2F
:       →  %3A
=       →  %3D
?       →  %3F
@       →  %40

For multi-byte UTF-8 characters (like accented Latin letters, CJK characters, or emoji), each byte in the UTF-8 encoding is percent-encoded individually. For example, the French word café — where é is encoded as the two bytes 0xC3 0xA9 in UTF-8 — becomes caf%C3%A9.

URL Encoding vs. URI Component Encoding

There are two subtly different variants of URL encoding that confuse many developers:

• Form encoding (application/x-www-form-urlencoded) — Used for HTML form GET submissions and many APIs. In this variant, spaces are encoded as + rather than %20. In PHP, this is urlencode(); in JavaScript, it is produced by new URLSearchParams().
• URI component encoding — More strict. Spaces become %20, and no reserved characters are left unencoded. In PHP, this is not directly available (but achievable via rawurlencode()); in JavaScript, it is encodeURIComponent().

When building query strings for REST APIs, prefer URI component encoding (encodeURIComponent / rawurlencode) to avoid ambiguity. When submitting HTML forms via GET, the browser handles encoding automatically.

When Do You Need to URL Encode Manually?

Browsers and many HTTP libraries handle URL encoding automatically for common cases, so you don't always need to think about it. However, you do need to encode manually in these situations:

1. Building URLs in code: When you concatenate user input or dynamic data into a URL string, always encode each component separately. Never encode the entire URL at once — that would also encode the slashes and colons that give the URL its structure.
2. API requests: When passing user-supplied values as query parameters to a REST API, percent-encode each value individually.
3. Redirect URLs: When embedding a redirect URL as a query parameter value (e.g., ?redirect=https://example.com/path), the entire redirect URL must be encoded.
4. Generating links from server-side templates: When outputting URLs in PHP, Python, Ruby, or any server-side language, encode values with the appropriate function.

URL Encoding in Different Languages

// Form-style encoding (space → +)
$encoded = urlencode("hello world & café");
// → hello+world+%26+caf%C3%A9

// Strict encoding (space → %20)
$encoded = rawurlencode("hello world");
// → hello%20world

// Encode a single query parameter value
encodeURIComponent("hello world & café");
// → "hello%20world%20%26%20caf%C3%A9"

// Encode a full URL (preserves :, /, ?)
encodeURI("https://example.com/café");
// → "https://example.com/caf%C3%A9"

Common Mistakes to Avoid

• Double encoding: Encoding a string that is already encoded produces broken output like %2520 (encoding the % sign itself). Always decode before re-encoding if you're unsure of the input state.
• Encoding the entire URL: You should only encode the values of query parameters, not the structural parts of the URL (scheme, host, path separators).
• Using encodeURI for query values: encodeURI does not encode &, =, or +, which means query parameter values containing those characters will break your URL structure. Always use encodeURIComponent for values.

Decoding URL-Encoded Strings

Decoding reverses the process: %20 becomes a space, %C3%A9 becomes é, and so on. Servers decode incoming request URLs automatically. In code, use urldecode() (PHP) or decodeURIComponent() (JavaScript).

If you need to quickly decode a percent-encoded string without writing code, use our free URL Decoder tool, or encode a string with our URL Encoder tool.