What Is URL Encoding and When Should You Use It?

A URL can only contain a limited set of characters. When you need to include data that contains spaces, ampersands, equal signs, or other special characters in a URL, those characters need to be encoded. URL encoding — also called percent-encoding — is the mechanism that makes this possible. Understanding it will save you hours debugging broken API requests and malformed links.

Why URLs need encoding

URLs have a specific structure: a scheme (https), a host (example.com), a path (/search), and a query string (?q=value). Characters like ?, &, =, #, and spaces are used to delimit the parts of this structure.

When the data you are sending contains these same characters, the browser or server cannot tell the difference between structural characters and data characters. The result is a broken URL or a misinterpreted request.

// Intended query: search for "coffee & tea"
https://example.com/search?q=coffee & tea

// What the server sees
?q=coffee     (query parameter value = "coffee")
& tea         (broken — the & starts a second parameter, and "tea" has no = sign)

URL encoding solves this by replacing problematic characters with a percent sign followed by their two-digit hexadecimal ASCII code.

How percent-encoding works

Every character has an ASCII code. URL encoding represents unsafe characters as %XX where XX is the character's hexadecimal value. Common examples:

The correctly encoded version of the earlier example:

https://example.com/search?q=coffee%20%26%20tea

The server decodes %20 back to a space and %26 back to &, so the query value is correctly received as "coffee & tea".

What should you encode?

You should encode the values of URL components, not the URL structure itself. If you encode the entire URL — including the slashes, the colon after https, and the question mark — you will destroy the URL's structure.

• Encode: query parameter values, path segment values that contain arbitrary user data
• Do not encode: the scheme (https://), the host (example.com), the path separators (/), or the query string delimiters (?, &, =)

URL encoding in code

Most languages provide built-in functions for URL encoding:

// JavaScript
encodeURIComponent("coffee & tea")  // → "coffee%20%26%20tea"
encodeURI("https://example.com/search?q=hello world")  // encodes space but not structural chars

// Python
from urllib.parse import quote
quote("coffee & tea")  // → "coffee%20%26%20tea"

// PHP
urlencode("coffee & tea")  // → "coffee+%26+tea" (uses + for spaces)
rawurlencode("coffee & tea")  // → "coffee%20%26%20tea" (uses %20)

Use encodeURIComponent in JavaScript when encoding individual parameter values. Use encodeURI only when encoding a full URL where you want to preserve structural characters.

%20 vs + for spaces

There are two conventions for encoding spaces in URLs. Standard percent-encoding uses %20. HTML form encoding (application/x-www-form-urlencoded) uses +. Both are valid in query strings, but %20 works everywhere while + only means a space in query string context. When in doubt, use %20.

FAQ

What is the difference between %20 and + for spaces in URLs?

%20 is the standard percent-encoding for a space and works everywhere in a URL. The + sign represents a space only in the query string of form-encoded data. Use %20 for general URL encoding.

Do I need to encode an entire URL or just parts of it?

Only encode query parameter values and path segments with user data. Do not encode the full URL or you will break the structural characters (://, /, ?, &) that define the URL.

Why does my API request fail when the URL contains special characters?

Characters like &, =, ?, #, and spaces have structural meaning in URLs. When they appear in parameter values without encoding, the server misinterprets them as URL structure. Percent-encoding tells the server to treat them as literal data.