URL Encoding Explained: What %20 Means and When to Use It

Why web addresses cannot contain spaces

You have probably seen a web address with strange characters in it — %20 where a space should be, or %26 where an ampersand should be. That is URL encoding at work: a way of writing characters that are not allowed in a web address using only safe ones. It looks messy, but it is one of the oldest and most reliable tricks on the web, and almost every link you click uses it somewhere.

A URL is only allowed to contain a small set of characters: letters, digits, and a handful of punctuation marks such as - . _ and ~. Anything else — spaces, quotation marks, angle brackets, curly braces, and characters from other alphabets — has to be rewritten before it can travel inside a URL. If it is not rewritten, browsers, servers and email programs may cut the link short, change it, or refuse it altogether.

What gets encoded, and what %20 really means

Encoding replaces each unsafe character with a percent sign followed by two hexadecimal digits that describe the character. A space becomes %20, an ampersand becomes %26, a question mark becomes %3F, an equals sign becomes %3D, a hash becomes %23, and a plus sign becomes %2B. These codes come from the character's position in the ASCII table, so they are the same everywhere on the web.

Characters from other alphabets, such as é, ü or اردو, are first converted to UTF-8 bytes, and then each byte is written as its own %XX code. That is why a single accented letter can become two percent codes, and a word in Urdu can become a long string of them. The browser reverses the process when it displays the page, which is why the address bar often shows the readable word while the real link underneath is encoded.

encodeURI vs encodeURIComponent: the one difference that matters

JavaScript, and most other languages, offer two encoding functions, and picking the wrong one is the most common encoding mistake. encodeURI is for a complete URL: it encodes spaces and unsafe characters but leaves the structure characters alone, so : / ? & = and # keep their jobs. Use it when you have a whole address and want to make it safe to share.

encodeURIComponent is for one value inside a URL, such as a search term or a name in a form. It encodes the structure characters too, so a value containing & or = cannot break the address apart. If you are building a link like example.com/search?q=, the search term after q= should go through encodeURIComponent, not encodeURI.

A quick way to remember it: encode the whole address with encodeURI, and encode each piece that goes inside it with encodeURIComponent. If you encode a whole URL with encodeURIComponent, every slash and question mark turns into a percent code and the link stops working. If you encode a value with encodeURI, an & inside it splits your value into two parameters and the server reads the wrong data.

Common mistakes to avoid

The most frequent mistake is double encoding: encoding a value that is already encoded. A space becomes %20 the first time, and %2520 the second time, because the percent sign itself gets encoded to %25. The server then decodes it once and sees %20 as literal text instead of a space. If your links show %25 in them, something in the chain encoded the same value twice.

Another common mistake is decoding input you do not trust. Decoding is safe for display, but a decoded value can contain characters that change what a link or a query does, so never paste decoded user input straight into a page or a database query without checking it. And remember that a plus sign in a query string usually means a space, not a literal plus — that is a form-encoding rule, not a URL rule, and mixing the two up is a classic source of broken searches.

Finally, do not encode everything out of habit. Plain letters, digits, hyphens, dots and underscores never need encoding, and over-encoding makes links unreadable without adding safety. Encode the parts that need it, leave the rest alone, and your links will be both safe and readable.

Frequently asked questions

What does %20 mean in a URL?

%20 is the encoded form of a space. URLs cannot contain a literal space, so the space is written as a percent sign followed by 20, its code in hexadecimal.

Is URL encoding the same as encryption?

No. Encoding only changes how characters are written so they can travel inside a URL; anyone can decode it. It does not hide or protect the data.

When should I use encodeURIComponent instead of encodeURI?

Use encodeURIComponent for a single value inside a URL, such as a search term, because it encodes &, = and ? too. Use encodeURI only for a complete URL, where those characters must keep their meaning.

Why does my link show %2520?

The value was encoded twice. The percent sign in %20 was itself encoded to %25, giving %2520. Decode once or encode only the original text to fix it.