What is URL encoding, and what should you encode?
URL encoding—formally percent-encoding—represents a byte as
% followed by two hexadecimal digits. It lets data coexist
with the characters that give a URI its structure.
What is percent-encoding?
RFC 3986 defines a percent-encoded octet as %HH, where each
H is a hexadecimal digit. A space byte, for example, is
%20, while a literal percent sign used as data is
%25.
Percent-encoding works on bytes, not directly on visual characters. For international text, characters are normally converted to UTF-8 and each byte outside the permitted URI set becomes its own percent triplet.
How Unicode becomes a URI component
One character can produce more than one escaped byte.
- Text input
café- UTF-8 bytes
63 61 66 C3 A9- URI component
caf%C3%A9
Reserved vs unreserved characters
Whether a character needs encoding depends on its role and component.
| Character group | Examples | Treatment |
|---|---|---|
| Unreserved | A-Z a-z 0-9 - . _ ~ | Normally remains literal; encoding it creates an equivalent but less readable URI |
| Reserved | :/?#[]@!$&'()*+,;= | Keep it when it is syntax; encode it when the same character is component data |
| Space | U+0020 (space) | Use %20 in a URI; + is a separate form-style convention |
| Unicode | é | Encode its UTF-8 bytes, producing %C3%A9 |
Encode data, preserve URL structure
Encode the value
A value such as rock & roll becomes
rock%20%26%20roll, preventing & from being
mistaken for a parameter separator.
Keep delimiters intact
When constructing a URL, encode individual path or query components.
Encoding the entire string also escapes :, /,
?, and other structural delimiters.
Encode it as data
Encoding a complete URL is appropriate when that URL itself is a query value, such as a redirect target inside another URL.