URL Encoding Explained: Percent-Encoding Special Characters

Last updated: October 9, 2026

URL encoding (officially percent-encoding, defined in RFC 3986) is how characters that are not safe inside a URL get represented. A URL can only legally contain a limited set of characters. Everything else — spaces, non-ASCII text, and reserved symbols — is written as %XX, where XX is the hexadecimal byte value of the character.

Common percent-encoding reference

Letters, digits, and the characters - . _ ~ never need encoding. Percent-encoding is case-insensitive for the letters: %2F and %2f are equivalent.

Non-ASCII text: UTF-8 first

Non-ASCII characters are encoded as their UTF-8 byte sequence, one %XX per byte. The Chinese text 你好 is three bytes per character in UTF-8, so it becomes six percent sequences:

你好  →  %E4%BD%A0%E5%A5%BD

encodeURIComponent vs encodeURI (JavaScript)

JavaScript offers two functions, and mixing them up is the classic bug:

// Encodes everything except A-Z a-z 0-9 - _ . ! ~ * ' ( )
encodeURIComponent("a b&c=d");  // "a%20b%26c%3Dd"

// Leaves the URL structure characters intact
encodeURI("https://example.com/a b"); // "https://example.com/a%20b"

• Use encodeURIComponent for query string values, path segments, and anything you build dynamically.
• Use encodeURI only when you have a whole URL and want to keep :// ? & = working.
• Never pass user input into a URL without encoding — a stray & or # silently changes what the URL means.

When you need URL encoding

• Building query strings: ?q=hello+world or ?q=hello%20world.
• Sending form data or JSON in a GET request.
• Embedding user-generated content in links.
• Debugging a URL that broke because a value contained a reserved character.