URL Encoding, Explained: What %20 Actually Is

Every space in a web address shows up as %20, and if you have ever wondered why, you are looking at percent-encoding — the standard way URLs carry characters they are not allowed to contain.

Why URLs cannot just have spaces

URLs use special characters structurally: ? starts the query, & separates parameters, # starts a fragment, / separates paths. If a value could contain any of those, the URL would be ambiguous. Percent-encoding solves this by reserving a safe alphabet and encoding everything else.

How %20 works

A percent sign followed by two hex digits represents one byte. Space is byte 0x20, hence %20. The "&" is 0x26, so a query value containing & becomes %26. The pattern is mechanical: take the UTF-8 bytes, write each as %XX.

"Hello world & friends" encodes to "Hello%20world%20%26%20friends"

Two encoding rules, one common bug

encodeURIComponent() encodes almost everything, making values safe inside a query string. encodeURI() leaves structure characters intact, keeping whole URLs readable. The classic bug: encoding an entire URL with the component rule turns its :// and & into garbage, breaking the link.

When it matters to you

• Links with spaces or symbols break when not encoded.
• Query values with user input must be encoded or they can corrupt the request.
• Emoji and accents need UTF-8 encoding to survive URLs.
• Some characters (like /) are structural in some positions and data in others — encoding depends on position.