How-to guide

How to URL Encode Text

URL encoding replaces characters that have meaning in a URL — spaces, ampersands, question marks, slashes — with a percent sign and their hexadecimal byte value. Encode each query value on its own rather than the whole URL, or the separators that make the URL work will be encoded too and the address will stop functioning.

URL Encoder and Decoder

Percent-encode text for URLs, or decode it back.

Open the tool

A URL is a structured string, and a handful of characters do structural work: ? starts the query, & separates parameters, = joins a name to its value, # begins the fragment, / separates path segments. Any of those appearing inside a value has to be escaped, or the receiving server reads it as structure.

The mistake almost everyone makes once is encoding the whole URL instead of the individual values. That escapes the separators as well, producing a single meaningless string rather than a working address.

Step by step

Identify what you are encoding
A single value going into a query parameter or path segment, or a complete URL. These need different treatment, and using the wrong one is the usual cause of a broken link.
Use component encoding for values
Component encoding escapes everything with structural meaning, including & ? = / and #. This is what you want for a search term, a redirect target or anything a user typed.
Use full-URL encoding only for a whole URL
This leaves the separators intact and escapes only characters that are never legal, such as spaces. Use it to tidy a URL you already have, never to prepare a value for insertion.
Watch the plus sign
In a query string a + means a space, a legacy of HTML form submission. In a path segment it is a literal plus. That is why a value containing + can arrive with it silently converted, and why %2B is safer when you mean a literal one.
Encode once, not twice
If your output contains %2520, a space became %20 and then the % became %25. Something encoded an already-encoded value. Decode until the value stops changing to find the original.

%20 or +: which one is right?

Both mean a space, but not in the same places. %20 is the RFC 3986 percent encoding and is correct anywhere in a URL. The plus sign comes from HTML form encoding (application/x-www-form-urlencoded) and means a space only inside a query string — in a path, + is a literal plus.

So generate %20 when you build URLs yourself, and expect to receive + from anything that submits a form. When you decode a query string, turn + into a space before percent-decoding; when you decode a path, do not.

Path segments versus query values

The characters that must be escaped depend on where the value goes.

A path segment must escape / as %2F, or it becomes two segments. ? and # must be escaped too, since they end the path.
A query value must escape & and =, which separate and assign parameters, plus # and a literal +.
A fragment is never sent to the server, so it only needs escaping for characters that are illegal in a URL at all.
Component encoding escapes all of these, which is why it is the safe default for any single value.

URL encoding in JavaScript, PHP and Python

Every language ships both flavours. The rule of thumb is the same in each: use the component or RFC 3986 function for a single value, and the form or query-builder function when you are assembling a whole query string. The outputs below were produced by running each call.

JavaScript

encodeURIComponent('café & bar')
// 'caf%C3%A9%20%26%20bar'  — one value

encodeURI('https://example.com/a b?q=1&x=2')
// 'https://example.com/a%20b?q=1&x=2'  — whole URL, separators kept

new URLSearchParams({ q: 'café & bar' }).toString()
// 'q=caf%C3%A9+%26+bar'  — form encoding, spaces as +

PHP

rawurlencode('café & bar');
// 'caf%C3%A9%20%26%20bar'  — RFC 3986, spaces as %20

urlencode('café & bar');
// 'caf%C3%A9+%26+bar'  — form encoding, spaces as +

http_build_query(['q' => 'café & bar']);
// 'q=caf%C3%A9+%26+bar'

Python

from urllib.parse import quote, quote_plus, urlencode

quote('café & bar', safe='')
# 'caf%C3%A9%20%26%20bar'

quote('a/b')             # 'a/b'   — / is left alone by default
quote('a/b', safe='')    # 'a%2Fb' — what a single value needs

urlencode({'q': 'café & bar'})
# 'q=caf%C3%A9+%26+bar'

Example

The same URL, encoded the right way and the wrong way.

Encoding just the value

/search?q=caf%C3%A9%20%26%20bar

Works: ? and & still separate,
only the value is escaped.

Encoding the whole URL

%2Fsearch%3Fq%3Dcaf%C3%A9%20%26%20bar

Broken: the separators are escaped,
so there is no query string left.

Frequently asked questions

What is the difference between component and full-URL encoding?

Component encoding escapes the structural characters too — & ? = / # — and is what you want for a value going into a URL. Full-URL encoding leaves those alone so an existing URL keeps working, and only escapes characters that are never legal.

Why does my plus sign become a space?

Because in a query string it means one, inherited from HTML form encoding. Anything reading the query decodes + as a space. To pass a literal plus, encode it as %2B.

What does %25 in my URL mean?

A percent sign that was itself encoded — the signature of double encoding. A space became %20, then the % became %25, giving %2520. Decode repeatedly until the value stops changing.

Do I need to encode non-English characters?

Technically yes, and every tool does it as UTF-8 bytes, which is why é becomes %C3%A9. Browsers display the readable form in the address bar but send the encoded one, so both are the same URL.

Is URL encoding a security measure?

No. It makes a value safe to transmit inside a URL, nothing more. It does not sanitise content for HTML, SQL or a shell — each of those needs its own escaping, applied at the point the value is used.

Tools used in this guide

All tools →

Reference tables

All references →

All guides →

Written by the Delimiter.live editorial team. Last reviewed 19 September 2026.