URL Encoding Explained: How to Handle Special Characters in URLs

URL encoding, also known as percent-encoding, is the process of converting characters into a format that can be safely transmitted in a URL. Since URLs can only contain a limited set of characters from the ASCII character set, any character outside this set must be encoded.

Encoded characters are represented as a percent sign (%) followed by two hexadecimal digits. For example: - A space becomes %20 - An ampersand (&) becomes %26 - A forward slash (/) becomes %2F - A question mark (?) becomes %3F

URL encoding is defined in RFC 3986 and is essential for ensuring that URLs are interpreted correctly by browsers, servers, and APIs.

URLs have a specific structure with reserved characters that serve special purposes:

Reserved Characters and Their Roles: - ? separates the path from query parameters - & separates multiple query parameters - = separates parameter names from values - # indicates a fragment identifier - / separates path segments - : separates the scheme from the authority

If your data contains any of these characters, they must be encoded to prevent the browser or server from misinterpreting them as URL structure.

For example, if a search query contains "salt & pepper", the URL must encode the ampersand: - Wrong: /search?q=salt & pepper (browser interprets & as parameter separator) - Correct: /search?q=salt%20%26%20pepper (ampersand is safely encoded)

Characters fall into three categories for URL purposes:

Unreserved Characters (Never Encode) These are safe to use as-is in any part of a URL: - Letters: A–Z, a–z - Digits: 0–9 - Special: hyphen (-), underscore (_), period (.), tilde (~)

Reserved Characters (Encode When Used as Data) These have special meaning in URLs and must be encoded when used as data values: : / ? # [ ] @ ! $ & ' ( ) * + , ; =

All Other Characters (Always Encode) Spaces, non-ASCII characters (like accented letters, Chinese characters, emoji), and control characters must always be percent-encoded.

A common example: spaces can be encoded as %20 or as + (plus sign). The + encoding is only valid in query string parameters (application/x-www-form-urlencoded). In path segments, always use %20.

Every major programming language provides URL encoding functions:

JavaScript: - encodeURIComponent() — Encodes a URI component (query parameter value). This is what you'll use most often. - encodeURI() — Encodes a full URI but preserves reserved characters like /, ?, and #. - decodeURIComponent() and decodeURI() for decoding.

Python: - urllib.parse.quote() for encoding and urllib.parse.unquote() for decoding. - urllib.parse.urlencode() to encode entire query string dictionaries.

PHP: - urlencode() encodes spaces as + (for form data). - rawurlencode() encodes spaces as %20 (RFC 3986 compliant).

Java: - URLEncoder.encode(string, "UTF-8") for encoding. - URLDecoder.decode(string, "UTF-8") for decoding.

The key distinction is between encoding a full URL and encoding a single parameter value. Always use the component-level function when encoding parameter values.

DevPik's free URL Encoder/Decoder tool lets you instantly encode or decode URLs and URL components.

Paste any URL or text, choose encode or decode, and get results instantly. The tool handles all special characters including spaces, ampersands, unicode characters, and emoji.

All processing runs entirely in your browser — no data is sent to any server. This is particularly important when working with URLs that contain authentication tokens, API keys, or sensitive parameters.