Guide
How to Percent-Encode a URL
Encode URLs and query components safely using the RFC 3986 reserved and unreserved character rules.
A URL may contain only a small set of characters directly. Percent-encoding writes anything else as a percent sign followed by two hexadecimal digits of its UTF-8 bytes. Which characters are safe depends on where in the URL they appear.
01Reserved versus unreserved
- Unreserved: A–Z, a–z, 0–9, and - . _ ~ — these never need encoding.
- Reserved: : / ? # [ ] @ ! $ & ' ( ) * + , ; = carry structural meaning, so they must be encoded when they are data inside a component.
- Encode a whole URL differently from a single query value: structural characters must stay intact.
02Limitations
Percent-encoding is not encryption and does not make untrusted input safe. Encode at the correct layer, and validate after decoding rather than trusting the encoded form.
Sources
- RFC 3986: Uniform Resource Identifier (URI): Generic Syntax — IETF (accessed 2026-09-27)
- encodeURIComponent() — JavaScript — MDN Web Docs (accessed 2026-09-27)