How to Properly Encode URLs in Your Web Applications

September 5, 2026 · 5 min read

Improperly encoded URLs are one of the most common sources of bugs in web applications. A space in a search query, an ampersand in a company name, or a non-English character in a user's name — any of these can break a URL if not handled correctly.

Characters That Must Be Encoded

Spaces become %20 (or + in query strings). & becomes %26. = becomes %3D. ? becomes %3F. # becomes %23. / becomes %2F (in path segments where it is literal, not a separator). Non-ASCII characters like é become their UTF-8 byte sequences: %C3%A9. Failing to encode these characters corrupts the URL structure.

Language-Specific Methods

JavaScript: encodeURIComponent() for parameter values, encodeURI() for full URLs. Python: urllib.parse.quote() for path segments, urllib.parse.urlencode() for query parameters. PHP: urlencode() for query strings, rawurlencode() for path segments. Each language has specific functions — using the wrong one produces subtle bugs.

Double Encoding

The most common encoding bug is double encoding — encoding a string that is already encoded. %20 becomes %2520. This happens when a framework automatically encodes output and the developer also encodes manually. If your URL contains %25 followed by hex digits, you likely have double encoding.

Testing Encoded URLs

Always decode a URL to verify it contains what you expect. Paste the encoded URL into a decoder to see the readable version. Test with special characters, international characters, and edge cases (empty strings, very long values, nested URLs as parameters). Our URL Encoder/Decoder tool handles both directions instantly.

Try It Now

Our free URL Encoder/Decoder handles this instantly — no signup, no limits.

Also useful: our Regex Tester for related calculations.