URL encoding explained: what %20 and those percent signs mean
You've seen it — a link full of %20, %3D, and %26. That's URL encoding (also called percent-encoding), and it's how the web safely carries characters that would otherwise break a link.
Why it exists
URLs are only allowed to contain a limited set of characters: letters, digits, and a few symbols. Anything outside that — spaces, non-English letters, or characters that already have a special meaning in a URL — has to be represented differently. URL encoding replaces each such character with a % followed by its two-digit hexadecimal code. A space becomes %20; an equals sign becomes %3D.
The characters that must be encoded
- Reserved characters that have a job in a URL:
? & = # / :. If they appear in your data rather than in the URL structure, they must be encoded, or the browser will misread where a parameter starts and ends. - Spaces →
%20(or sometimes+in query strings). - Non-ASCII characters like accented letters or other scripts, which are encoded as their UTF-8 bytes.
The classic bug it prevents
Imagine putting a search term like rock & roll straight into a URL parameter. The & would be read as the start of a new parameter, and your value would be cut to rock. Encoding it to rock%20%26%20roll keeps the whole value intact.
Encoding vs. decoding
Encoding turns readable text into the percent form for safe transport; decoding reverses it so you can read what a URL actually contains. When you're debugging a link, decoding it is often the quickest way to see the real parameters. Like Base64, this is about transport, not security — anyone can decode a URL.