Percent encoding (also known as URL encoding) is how the internet transmits non-ASCII characters, spaces, and reserved syntax safely through web addresses. From query strings to API endpoints and OAuth redirects, percent encoding ensures your parameters arrive without corruption or broken parsing.
Despite being fundamental to web development, mixing up %20 vs +, forgetting to encode reserved characters like & or #, or double-encoding (%25) are among the most common bugs in web applications.
How percent encoding works
Under RFC 3986, characters permitted in a URI are divided into unreserved and reserved characters. Any character outside the unreserved set must be represented by a percent sign (%) followed by the two-digit hexadecimal representation of its byte value in UTF-8.
- Unreserved characters (never encoded): A-Z, a-z, 0-9, hyphen (-), underscore (_), period (.), tilde (~).
- Reserved characters (encoded when used as data): !, *, ', (, ), ;, :, @, &, =, +, $, ,, /, ?, %, #, [, ].
- Space character: %20 (or + in HTML form query strings).
%20 versus +: Which should you use for spaces?
One of the most frequent points of confusion is whether to represent spaces as %20 or +:
- Use %20: In URL path segments (/docs/user%20guide), modern REST APIs, and whenever adhering strictly to RFC 3986.
- Use +: Only in standard application/x-www-form-urlencoded form POST bodies and traditional browser query strings (?search=web+tools).
# Valid path with %20: https://example.com/files/my%20document.pdf # Valid query with %20: https://example.com/search?q=free%20tools
The reserved character trap: Why & and = break URLs
Suppose you have a parameter value "Ben & Jerry". If you concatenate it into a query string without percent-encoding, the URL becomes:
https://example.com/api?brand=Ben & Jerry
The server interprets "brand=Ben " as parameter 1, and "Jerry" as an empty parameter 2. By properly percent-encoding the ampersand as %26, the server receives the complete value intact: "?brand=Ben%20%26%20Jerry".
How to avoid double encoding bugs
Double encoding occurs when an already-encoded string is passed through an encoder a second time. The % sign itself (%25) gets encoded, turning "%20" into "%2520". Always encode at the moment of constructing query components, and decode once when extracting.
Frequently asked questions
Percent encoding (URL encoding) is a mechanism for converting characters not allowed in standard ASCII URI syntax into safe %XX hexadecimal byte sequences (e.g., space becomes %20).
%20 is the standard RFC 3986 percent-encoding for spaces in URL path and query components. The plus sign (+) is only valid for spaces in application/x-www-form-urlencoded query strings and HTML forms.
Characters like &, =, ?, and # have structural meaning in URLs. If a search query contains "rock & roll", an unencoded & will split the value into two separate unintended query parameters.
You can use ToolOrbit's free URL Encode / Decode tool to encode individual parameters (component mode) or entire URLs safely in your browser.
