URL encoding

Definition

URL encoding, more precisely percent-encoding, represents a byte with % followed by two hexadecimal digits. For example, a space can be written as %20 and a literal percent sign as %25.

The unreserved URI characters—ASCII letters, digits, -, ., _, and ~—normally remain unchanged. Other characters may need encoding depending on their position and meaning in the URI.

How it works

For non-ASCII text, an application first converts characters to bytes, usually with UTF-8, and percent-encodes the necessary bytes individually. Thus café becomes caf%C3%A9 in UTF-8.

Reserved characters such as /, ?, #, &, and = structure a URL. Whether they must be encoded depends on whether the data belongs to a path segment, query parameter, fragment, or another component.

Spaces and form data

Standard percent-encoding writes a space as %20. The form format application/x-www-form-urlencoded, commonly used for query strings and HTML forms, often writes a space as +; a literal plus sign must then be encoded as %2B.

Libraries usually provide separate functions for complete URLs, path segments, and query parameters. Using the component-specific function prevents delimiters from being escaped or preserved incorrectly.

Security and pitfalls

Percent-encoding is reversible and is not encryption. Sensitive values remain exposed in browser history, logs, referrer data, and server records unless protected by appropriate transport and application controls.

Encoding an already encoded percent sign causes double encoding—for example, %20 becomes %2520. Decoded input must still be validated because encoding does not make malicious or malformed data safe.