url encode
Escaped in the page, nothing sent anywhere.
The short answer
A URL gives special meaning to ? & = / and #, so a value containing any of them has to be escaped before it goes in one. Percent-encoding replaces each byte with a % and its hexadecimal value, which is why a space becomes %20.
A URL gives special meaning to ? & = / and #, so any value containing them has to be escaped first. This does that, including the non-ASCII characters that need it too.
The formula
each reserved or non-ASCII byte → % followed by two hex digits
Worked examples
- a space
- a%20space
- tea&biscuits
- tea%26biscuits
- café
- caf%C3%A9
Reference table
| Character | Encoded | What it means in a URL |
|---|---|---|
| space | %20 | Ends the URL in some parsers |
| & | %26 | Separates one parameter from the next |
| = | %3D | Separates a name from its value |
| / | %2F | Separates path segments |
| # | %23 | Starts the fragment |
How to use it
- 01Paste the valueThe thing going inside the URL, not the whole URL.
- 02Copy the escaped versionDrop it into the query string or path segment where it belongs.
Also searched for
Searches that land here include url encode, percent encoding, encode url online, url encoder and escape url characters.
Percent-encoding, and when you need it
The reserved characters
A URL is a structure, and a handful of characters hold it together: ? starts the query, & separates parameters, = separates a name from its value, / separates path segments, and # starts the fragment. A value containing any of those has to be escaped, or the parser on the other end will read your data as structure.
Encoding a component, not a URL
The distinction that trips people up is between escaping a whole URL and escaping one piece of it. The piece is almost always what you want. A redirect parameter is the clearest case: the URL you are redirecting to has to be fully escaped to sit inside the URL you are building, colons and slashes included.
Double encoding
Escape something twice and % becomes %25, so %20 becomes %2520 and the value arrives with visible escapes in it. This usually happens when two layers of code both try to be helpful. If you are seeing %2520 in a log, one of the two layers should stop.
Questions people ask
Why is a space %20 and sometimes +?
%20 is the correct percent-encoding of a space anywhere in a URL. The plus sign is a separate, older convention that means a space only inside a form submission body, and only there. Using + in a path is a bug that produces a literal plus sign; using %20 always works.
Should I encode the whole URL?
No. Encoding a whole URL escapes the slashes and colons that make it a URL, which produces one long unusable string. Encode the individual values you are putting into it: a search term, a filename, a redirect target.
What happens to accents and other alphabets?
They are encoded as their UTF-8 bytes, two or three percent escapes per character, which is why é becomes %C3%A9. Browsers display those back as the original letters in the address bar, so the ugly version is mostly something only your code sees.