URL Encoding Explained: Percent-Encoding and Special Characters
URLs can only contain a limited set of characters. Characters outside that safe set must be percent-encoded. Understanding which characters need encoding, and where, prevents a whole category of web application bugs.
Free URL Encoder / DecoderEncode or decode URL strings instantly.
Open URL Encoder →How Percent-Encoding Works
A percent-encoded character is %XX where XX is the uppercase hex byte value. Space (0x20) → %20. é (UTF-8 bytes C3 A9) → %C3%A9.
Original: hello world & more
Encoded: hello%20world%20%26%20more
Safe vs Reserved Characters
| Category | Characters | Encode? |
|---|---|---|
| Unreserved | A-Z a-z 0-9 - _ . ~ | Never |
| Reserved (structural) | : / ? # [ ] @ ! $ & ' ( ) * + , ; = | Only as data |
| Everything else | Spaces, non-ASCII | Always |
Path vs Query String
In the path, encode literal slashes as %2F. In query strings, encode & as %26 and = as %3D in values. Use %20 for spaces everywhere — it is unambiguous in all contexts.
JavaScript Functions
encodeURIComponent('k=v&x') → k%3Dv%26x (for query values)encodeURI('https://x.com/hello world') → https://x.com/hello%20world (full URLs)
Security note: URL encoding is not a defense against XSS or SQL injection. Always validate server-side.