URL encoding

What URL encoding is

A URL may contain only a small set of ASCII characters, and some of them have a job: / separates folders, ? starts the query, & separates parameters. Any other character, and a special one used as plain text, is written as % followed by the two hexadecimal digits of each of its bytes. This is called URL encoding or percent-encoding.

Today the bytes are those of UTF-8, so é (two bytes in UTF-8) becomes %C3%A9. Old sites sometimes used the bytes of a one-byte code page such as Windows-1252, where é is %E9; the table below shows both.

Which characters to encode

• Never encoded: letters A–Z a–z, digits and - . _ ~.
• Encoded when they are data, left as they are when they do their job: : / ? # [ ] @ ! $ & ' ( ) * + , ; =. A & inside a parameter value must become %26, or it starts a new parameter.
• Always encoded: the space, % itself (%25), control characters, quotes, < > and every non-ASCII character.

%20 or +

In a path a space is %20. HTML forms send their fields as application/x-www-form-urlencoded, where a space in the query is a +, and a real plus sign has to be %2B. Servers decode + as a space only in the query string. When in doubt, %20 works everywhere.

Encode in code and in the terminal

The same text, café & co/1, encoded by several tools on 26 October 2026. Python:

python3 -c "from urllib.parse import quote; print(quote('café & co/1'))"

caf%C3%A9%20%26%20co/1

quote leaves / alone, because it expects a path. For a single value pass safe='':

python3 -c "from urllib.parse import quote; print(quote('café & co/1', safe=''))"

caf%C3%A9%20%26%20co%2F1

PHP has two functions: rawurlencode writes spaces as %20, urlencode as +, like a form:

php -r 'echo rawurlencode("café & co/1"), PHP_EOL, urlencode("café & co/1"), PHP_EOL;'

caf%C3%A9%20%26%20co%2F1 caf%C3%A9+%26+co%2F1

JavaScript, here in Node.js: encodeURIComponent encodes one value, encodeURI a whole address and leaves its : / ? & alone:

node -e 'console.log(encodeURIComponent("café & co/1")); console.log(encodeURI("https://example.com/a b?q=café"))'

caf%C3%A9%20%26%20co%2F1 https://example.com/a%20b?q=caf%C3%A9

curl encodes query parameters with --data-urlencode; -G puts them into the URL of a GET request:

curl -s -o /dev/null -G --data-urlencode "q=café & co" -w '%{url_effective}\n' http://127.0.0.1:8080/search/

http://127.0.0.1:8080/search/?q=caf%c3%a9+%26+co

Upper or lower case hex digits mean the same. Decoding is the reverse; in Python unquote('caf%C3%A9%20%26%20co') gives back café & co.

Table: Windows-1252 and UTF-8

Every printable character of Windows-1252, with its encoding from that code page and from UTF-8. ASCII characters are the same in both. Windows-1252 leaves the bytes 81, 8D, 8F, 90 and 9D undefined, so they are missing. The table was generated from the encodings themselves.

Article authors: Andrei Olegovich, Klavdiya Kondakova