What is URL encoding?
URL encoding (also called percent-encoding) is the mechanism for representing characters in a URL that aren't allowed in the standard ASCII character set or that have special meaning in URL syntax. Defined by RFC 3986, it replaces unsafe characters with a % sign followed by two hexadecimal digits representing the character's byte value.
For example, a space becomes %20, an ampersand becomes %26, and a forward slash becomes %2F. Non-ASCII characters (like accented letters or emoji) are first encoded as UTF-8 bytes, then each byte is percent-encoded individually — so the é character (U+00E9) becomes %C3%A9 (two UTF-8 bytes).
URLs have a strict syntax where characters like ?, #, &, and = serve as structural delimiters. If these characters appear in data (like a search query containing an ampersand), they must be percent-encoded to prevent the URL parser from misinterpreting them as structural boundaries.
When to encode URLs
Query parameters with special characters — if a parameter value contains &, =, #, or spaces, it must be encoded. The URL ?q=rock&roll has two parameters (q=rock and roll=), while ?q=rock%26roll correctly passes the single value "rock&roll".
User-generated content in URLs — any time user input becomes part of a URL (search queries, profile names, file paths), encode it to prevent URL injection and broken links.
API requests — when constructing API calls programmatically, always encode parameter values. Most HTTP client libraries do this automatically, but manual URL construction requires explicit encoding.
Redirects and callbacks — OAuth flows and payment gateways often pass URLs as parameter values (e.g. ?redirect_uri=https%3A%2F%2Fexample.com%2Fcallback). The inner URL must be fully encoded.