How to URL Encode a String

What is URL encoding?

URLs can only contain a limited set of characters. When a URL needs to include characters outside that set — like spaces, special characters, or non-ASCII text — those characters must be percent-encoded.

Percent encoding replaces each unsafe character with a %followed by two hexadecimal digits representing the character's byte value.

Hello World  →  Hello%20World
café         →  caf%C3%A9
user@email   →  user%40email

Which characters are safe?

The following characters are safe in URLs and never need encoding:

A-Z  a-z  0-9  -  _  .  ~

All other characters — including spaces, &, =, ?, /, and any Unicode characters — must be encoded when used as data (not as URL structure).

Common encoded characters

Encoding in JavaScript

JavaScript has two functions for URL encoding — use the right one:

const query = encodeURIComponent('hello world & more');
// "hello%20world%20%26%20more"

const url = `https://example.com/search?q=${query}`;
// "https://example.com/search?q=hello%20world%20%26%20more"

const url = encodeURI('https://example.com/path with spaces');
// "https://example.com/path%20with%20spaces"

// Does NOT encode: : / ? # [ ] @ ! $ & ' ( ) * + , ; =

decodeURIComponent('hello%20world%20%26%20more');
// "hello world & more"

decodeURI('https://example.com/path%20with%20spaces');
// "https://example.com/path with spaces"

Encoding in Python

from urllib.parse import quote, quote_plus, unquote

# Encode a path segment
quote('hello world')          # "hello%20world"
quote('café')                 # "caf%C3%A9"

# Encode a query parameter value (space becomes +)
quote_plus('hello world')     # "hello+world"
quote_plus('a=1 & b=2')       # "a%3D1+%26+b%3D2"

# Decode
unquote('hello%20world')      # "hello world"
unquote('caf%C3%A9')          # "café"

quote_plus encodes spaces as + instead of %20, which is the standard for HTML form submissions (application/x-www-form-urlencoded).

Space: %20 or +?

Both %20 and + represent a space, but in different contexts:

• %20 — correct in URL paths and in modern query strings (RFC 3986)
• + — only valid in HTML form data (application/x-www-form-urlencoded)

When in doubt, use %20. It is always correct. A + in a URL path is a literal plus sign, not a space.

Common mistakes

• Double-encoding — encoding an already-encoded value turns %20 into %2520. Always decode before re-encoding.
• Using encodeURI for query values — it does not encode & and =, which will break your query string.
• Forgetting to encode non-ASCII characters — accented letters, emoji, and CJK characters must all be encoded.
• Treating + as %20 in paths — outside of form data, a + in a path is a literal plus sign.