Updated July 1, 2026
URL encoding reference
URL (percent) encoding replaces characters that are unsafe or reserved in a URL with a % followed by their hex byte value. This sheet lists the characters you most often need to encode.
Common encoded characters
Reserved and unsafe characters and their percent-encoded form (UTF-8).
| Character | Encoded | Name / note |
|---|---|---|
(space) | %20 | Space (or + in query strings) |
! | %21 | Exclamation mark |
# | %23 | Fragment delimiter |
$ | %24 | Dollar sign |
% | %25 | Percent — the escape character itself |
& | %26 | Query parameter separator |
' | %27 | Apostrophe |
+ | %2B | Plus (means space in query strings) |
, | %2C | Comma |
/ | %2F | Path separator |
: | %3A | Scheme / port separator |
; | %3B | Semicolon |
= | %3D | Key-value separator |
? | %3F | Query string delimiter |
@ | %40 | At sign |
[ | %5B | Left bracket (IPv6 / arrays) |
] | %5D | Right bracket |
Unreserved characters are never encodedLetters
A-Z a-z, digits 0-9, and - _ . ~ are safe and should stay as-is. Encoding them is unnecessary and can even break some comparisons.Space: %20 vs +In a path, a space is
%20. In a query string, a space is often written as + (a legacy from form encoding). Decoders must know the context to handle + correctly.References
Questions
Why is a space shown as %20?
Spaces are not allowed in a URL, so they are percent-encoded. The byte value of a space is 0x20, which becomes %20. In query strings it is sometimes written as + instead.
Which characters do I need to URL-encode?
Encode reserved characters (like ? & # / : =) when they appear in data rather than as delimiters, plus anything outside the unreserved set A-Z a-z 0-9 and - _ . ~.