Why and How to URL Encode Text
Last updated 2026-09-11
URLs can only safely contain a limited set of characters — URL encoding (percent-encoding) converts everything else into a safe, unambiguous form.
Understand what needs encoding
Spaces, and characters with special meaning in a URL (&, ?, #, =, /, +) or outside the basic ASCII range, need to be encoded before they appear safely in a URL.
Know the encoding format
Each unsafe character is replaced with a % followed by its two-digit hexadecimal byte value. A space becomes %20, and & becomes %26.
Decode when reading values back
The same table is used in reverse — decoding converts %20 back to a space, and so on.
Example
"hello world & friends" encodes to "hello%20world%20%26%20friends".
Important Considerations
- Query string values and URL path segments have slightly different rules about which characters need encoding — a space in a query string is sometimes represented as + rather than %20.
- Encoding a URL twice (double-encoding) is a common bug — always check whether a string is already encoded before encoding it again.
Frequently Asked Questions
- Why do spaces sometimes become + and sometimes %20?
- The + convention comes from the older application/x-www-form-urlencoded format used for form submissions. %20 is the general percent-encoding for a space and works everywhere.
- Do I need to encode an entire URL?
- No — only the parts that could contain unsafe characters, such as query parameter values. Encoding the URL's structural characters (like the leading https://) would break it.