URL Encoding, Explained Simply

You've almost certainly seen a URL full of %-signs and wondered what they mean. URL encoding looks cryptic, but the rule behind it is simple once you see it.

The problem URL encoding solves

URLs can only safely contain a limited set of characters — letters, digits, and a handful of punctuation marks like -, _, and .. Anything outside that set (spaces, ampersands, non-English characters, and more) has to be represented differently, or it risks being misinterpreted by servers and browsers along the way.

How the encoding actually works

Each unsafe character is replaced with a percent sign followed by its byte value in hexadecimal. That's why a space becomes %20 — 20 is the hex value for the space character's underlying byte.

A few common examples:

• Space → %20
• & → %26
• ? → %3F
• é → %C3%A9 (a two-byte UTF-8 sequence)

Why this matters for query strings

Query strings use & to separate parameters and = to assign values, so if your actual data contains either character, it has to be encoded — otherwise the URL parser will misread where one parameter ends and the next begins.

For example, searching for "salt & pepper" needs to become:

https://example.com/search?q=salt%20%26%20pepper

Without encoding the ampersand, the URL would look like it has two separate parameters instead of one search phrase containing an ampersand.

Decoding is just the reverse

Decoding reverses the process — every %XX sequence gets converted back to its original character. This is why decoding malformed input (like a stray % not followed by two valid hex digits) can fail — the decoder doesn't know what byte to reconstruct.

When you'll actually need this

Most of the time, your browser and framework handle URL encoding automatically. You'll want to do it manually when:

• Building a URL by hand that includes user-provided text (like a search query)
• Debugging a broken link that has oddly truncated parameters
• Passing structured data (like JSON) as a single query parameter

Once you know that URL encoding is just "represent unsafe characters as their byte value in hex," the percent signs stop looking mysterious and start looking like exactly what they are: a simple, reliable translation layer.