URL Encoding Explained: What Those %20 Characters Mean
Ever copied a link and seen search?q=elden%20ring%20build in the address bar? Those %20 chunks aren't garbage — they're percent-encoding, the system that lets URLs carry characters they were never designed for. Understanding it takes ten minutes and saves hours of debugging broken links.
Why URLs Need Encoding at All
The URL specification reserves certain characters for structure: ? starts the query string, & separates parameters, # jumps to an anchor, / splits path segments. When your data contains those same characters, the server can't tell structure from content. A search for "salt & pepper" becomes two parameters: "salt " and a mangled "pepper".
Percent-encoding solves this by replacing any unsafe byte with % followed by its hexadecimal value. A space (byte 32, hex 20) becomes %20. An ampersand becomes %26. Non-ASCII text like Chinese or emoji gets UTF-8 encoded first, then each byte percent-encoded — which is why encoded URLs with international text look so long.
Which Characters Are Actually Safe?
The "unreserved" set that never needs encoding is smaller than people think: A-Z a-z 0-9 plus - _ . ~. Everything else — spaces, slashes inside values, plus signs, non-English text — should be encoded when it appears inside a parameter value. When in doubt, encode: servers decode it transparently.
Encoding and Decoding in Practice
The URL encoder/decoder on this site does the job locally in your browser:
- Paste the parameter value (not the whole URL — more on that below) into the input.
- Click Encode →. "Elden Ring: Shadow of the Erdtree" becomes
Elden%20Ring%3A%20Shadow%20of%20the%20Erdtree. - Drop that into your query string:
?q=Elden%20Ring%3A... - To read an encoded URL, paste it and click ← Decode — full URLs decode fine.
The Whole-URL Mistake
The tool uses JavaScript's encodeURIComponent — the strict, correct function for parameter values — which encodes even : and /. That means you should encode just the value, not a complete URL. If you encode https://example.com/search?q=a b in one pass, the https:// structure gets escaped too, producing a broken blob. Encode the pieces, keep the structure readable.
Double Encoding: The Silent Link Killer
If you've ever seen %2520 in a URL, you've met double encoding: a string that got encoded twice. The first pass turned the space into %20; the second encoded the % itself into %25. The server decodes once and receives a literal "%20" instead of a space. The fix is process discipline — encode exactly once, at the point where you build the URL. If you inherited a broken link, decode it repeatedly until it reads clean, then rebuild it with a single encoding pass.
Is Encoding a Way to Hide Data?
No — anyone can decode it instantly. Percent-encoding exists for transport safety, not secrecy. If you need to actually protect a value in a URL, that's encryption or a signed token's job, not encoding's.