URL Encoding Explained: Percent-Encoding Without the Jargon
Learn why URL characters become %20 and similar sequences, what should be encoded, and how double encoding happens.
A URL uses punctuation such as :, /, ?, &, =, and # to separate parts of the address. When one of those characters needs to appear inside data rather than as syntax, it may need percent-encoding.
What %20 means
Percent-encoding writes a byte as a percent sign followed by two hexadecimal digits. In UTF-8/ASCII, a space byte is hexadecimal 20, so it can appear as %20.
Encode the value, not necessarily the whole URL
Suppose a query parameter value is red & blue. The ampersand would normally separate query parameters, so the value needs encoding before it is inserted into the URL. In application code, use the URL or query-string APIs provided by the language rather than manually replacing a few characters.
Why plus signs can be confusing
Form-style query encoding often represents a space as +. A literal plus sign must then be encoded so the receiver can tell the difference. This behavior is related to form encoding rather than a universal “plus always means space” rule for every URL component.
Unicode characters
Non-ASCII characters are normally encoded as UTF-8 bytes and then each relevant byte is percent-encoded. That is why one visible character can turn into several percent sequences.
Double encoding
If the string %20 is encoded again, the percent sign becomes %25, producing %2520. When debugging a URL that contains lots of %25, check whether a layer encoded an already encoded value.
Encoding is not security
Percent-encoding is reversible representation. Sensitive values in URLs can still leak through history, logs, analytics, screenshots, and referrer information.