Click a link with %20 or %3F in it and you’ve met URL encoding without realizing it. URLs are allowed to contain only a small set of characters, so anything outside that set — a space, an accented letter, an ampersand inside a search term — has to be translated into a safe form before it can travel across the web. That translation is URL encoding, also called percent encoding because every encoded character starts with a %. This guide explains what URL encoding is, why it exists, exactly which characters need it, and how to encode or decode a URL in seconds.
Why URLs need encoding at all
A URL is a precise instruction, and several characters in it have special structural meaning. A ? marks the start of a query string, & separates parameters, / divides path segments, and # introduces a fragment. So what happens when your data contains one of those characters?
Imagine searching for “fish & chips”. If you drop the raw ampersand straight into a URL:
https://example.com/search?q=fish & chips
…the browser sees the & as a parameter separator and the space as the end of the URL. The query breaks. Encoding fixes this by replacing the problem characters with safe codes:
https://example.com/search?q=fish%20%26%20chips
Now %20 represents the space and %26 represents the ampersand, so the whole phrase is treated as a single value. The URL is unambiguous again.
How percent encoding works
The mechanism is simple and consistent. To encode a character:
- Look up the character’s byte value in the UTF-8 character set.
- Convert that byte to its two-digit hexadecimal number.
- Put a
%in front of it.
So a space (byte value 32, hex 20) becomes %20. An @ (byte 64, hex 40) becomes %40. Characters outside the basic ASCII range — like é or an emoji — become multiple percent codes, one for each UTF-8 byte. For example é encodes to %C3%A9 because it’s two bytes in UTF-8.
Here’s a reference table of the characters you’ll meet most often:
| Character | Encoded | Why it needs encoding |
|---|---|---|
| Space | %20 | Spaces aren’t allowed in URLs |
! | %21 | Reserved sub-delimiter |
# | %23 | Marks a fragment |
$ | %24 | Reserved |
& | %26 | Separates query parameters |
+ | %2B | Means “space” in query strings, so a literal + must be encoded |
/ | %2F | Separates path segments |
: | %3A | Separates scheme and port |
? | %3F | Starts the query string |
@ | %40 | Reserved for user info |
= | %3D | Assigns a value to a parameter |
Reserved vs unreserved characters
Not every character needs encoding. The URL specification (RFC 3986) splits characters into groups:
- Unreserved characters never need encoding: the letters
A–Zanda–z, the digits0–9, and four symbols: hyphen-, period., underscore_, and tilde~. - Reserved characters have special meaning (
/ ? # [ ] @ ! $ & ' ( ) * + , ; =). They’re only encoded when you want them treated as literal data rather than as structure. - Everything else — spaces, accented letters, most punctuation, non-Latin scripts — must always be encoded.
This is why the slug generator strips text down to unreserved characters when building a URL slug: a slug made only of lowercase letters, numbers, and hyphens never needs encoding and stays clean and readable. See how to create SEO-friendly URLs for why that matters for search.
The + vs %20 confusion
One quirk trips people up constantly: in the query string portion of a URL, a + traditionally means a space. So q=fish+chips and q=fish%20chips can both mean “fish chips”. But in the path portion, + means a literal plus sign. This inconsistency is exactly why a literal + in your data should be encoded as %2B — otherwise a server might silently turn it into a space. When in doubt, encode it and remove the ambiguity.
Component encoding vs full-URL encoding
This is the most important practical distinction, and getting it wrong is the usual cause of broken links.
- Encode a component (one piece of data, like a single query value) and you want everything unsafe escaped, including
/,?, and&, because those are data, not structure. - Encode a full URL and you must preserve the structural characters — the
://, the/path separators, the?and&— or you’ll destroy the URL by encoding its own punctuation.
A worked example. You have a search term a/b?c that you want to put into a URL:
https://example.com/search?q=a%2Fb%3Fc
The term’s / and ? are encoded (%2F, %3F) because they’re data. But the URL’s own ? before q= is left alone because it’s structure. The URL encoder / decoder offers both modes — component and full-URI — so you can pick the right one instead of guessing.
How to encode or decode a URL
You don’t need to memorize hex codes. To convert in either direction:
- Open the URL encoder / decoder.
- Paste your text or URL.
- Choose Encode to make it URL-safe, or Decode to turn
%codes back into readable characters. - Pick component mode for a single value, or full URI mode for a whole URL.
- Copy the result.
It handles full Unicode, so accented characters and non-Latin scripts encode to the correct multi-byte sequences, and it runs entirely in your browser — useful when a URL contains a token or personal data you’d rather not paste elsewhere.
A quick round trip
| Direction | Input | Output |
|---|---|---|
| Encode | name=John Doe&city=São Paulo | name%3DJohn%20Doe%26city%3DS%C3%A3o%20Paulo |
| Decode | caf%C3%A9%20%26%20bar | café & bar |
URL encoding vs related encodings
URL encoding is easy to confuse with its neighbors, but each does a distinct job:
| Encoding | Purpose | Looks like |
|---|---|---|
| URL / percent | Make text safe inside a URL | %20, %26 |
| Base64 | Represent binary data as text | SGVsbG8= |
| HTML entities | Show reserved characters in HTML | &, < |
They sometimes appear together — an API response in JSON might carry a URL-encoded link inside a Base64-encoded field — but they’re independent transformations applied for different reasons. None of them is encryption; all are public and reversible.
When you’ll need URL encoding
You’ll reach for it whenever user-supplied or unpredictable text goes into a URL:
- Building search or filter links where the query contains spaces or symbols.
- Passing data between pages in query parameters.
- Constructing API request URLs by hand.
- Embedding a URL inside another URL (a redirect target, for instance) — the inner URL must be fully encoded.
- Debugging a link that “breaks” after a certain character.
For most everyday links you create from clean titles, encoding is unnecessary if you use the slug generator to produce safe slugs in the first place — prevention beats cure.
The bottom line
URL encoding (percent encoding) replaces characters that aren’t allowed in a URL with a % followed by their hexadecimal byte value, so that spaces, accented letters, and reserved symbols can sit inside a link without breaking it. Only unreserved characters (letters, digits, and - . _ ~) are always safe; reserved characters are encoded when they’re data rather than structure — which is why choosing component vs full-URL mode matters. To encode or decode in either mode with full Unicode support and nothing leaving your browser, use the URL encoder / decoder.
Frequently Asked Questions
What is URL encoding in simple terms?
URL encoding, also called percent encoding, replaces characters that aren’t allowed in a URL — like spaces and & — with a % followed by a two-digit code. This lets a URL safely carry data that contains special characters without breaking.
Why is a space shown as %20 in URLs?
A space isn’t a legal character in a URL, so it’s encoded as %20 — the percent sign plus the hexadecimal byte value (20) of a space. In query strings you may also see a + used to represent a space.
What characters need to be URL encoded?
Everything except the unreserved set: letters A–Z/a–z, digits 0–9, and the symbols - . _ ~. Reserved characters like / ? # & = are encoded when they’re part of your data rather than the URL’s structure; spaces and accented characters are always encoded.
What’s the difference between encoding a component and a full URL?
Encoding a component escapes everything unsafe, including / and ?, because the whole string is treated as data. Encoding a full URL preserves the structural characters so the URL stays valid. The URL encoder / decoder offers both modes.
Is URL encoding the same as Base64?
No. URL encoding escapes characters so text is safe inside a URL, using % codes. Base64 represents binary data as 64 plain-text characters. They serve different purposes and produce very different-looking output.
How do I decode a URL-encoded string?
Paste it into the URL encoder / decoder and choose Decode. It converts the % codes back into readable characters with full Unicode support, entirely in your browser, so nothing is uploaded.