URL Encoding Cheat Sheet — Every Special Character, Code & Rule in One Place

URL encoding converts unsafe characters into percent-encoded values that work in any URL. A space becomes %20, an ampersand becomes %26, and a hash becomes %23. This cheat sheet covers every character code, the encoding rules, and when you actually need to encode.

If you have ever seen %20 or %26 in a URL and wondered what it means, this is the complete reference. Every special character, its encoded value, and the rule that determines whether it needs encoding or not.

Essential URL Encoding Table — Most Common Characters

These are the characters you will encode most often. Bookmark this table:

Character	Name	URL Encoded	Notes
(space)	Space	%20	Use %20 everywhere. + works only in form data.
!	Exclamation	%21	Unreserved in RFC 3986 but some APIs require encoding
"	Double Quote	%22	Always encode in URLs
#	Hash / Pound	%23	Reserved — starts fragment. Always encode in data.
$	Dollar Sign	%24	Reserved sub-delimiter
%	Percent	%25	Always encode — otherwise looks like an encoding prefix
&	Ampersand	%26	Reserved — separates query params. Always encode in values.
'	Single Quote	%27	Encode to prevent injection issues
(	Open Paren	%28	Sub-delimiter, encode in strict contexts
)	Close Paren	%29	Sub-delimiter, encode in strict contexts
*	Asterisk	%2A	Sub-delimiter
+	Plus	%2B	Reserved in form data (means space). Encode to send literal +.
,	Comma	%2C	Sub-delimiter, often left unencoded
/	Forward Slash	%2F	Reserved path delimiter. Encode when slash is data, not path.
:	Colon	%3A	Reserved — separates scheme, port. Encode in data.
;	Semicolon	%3B	Reserved sub-delimiter
<	Less Than	%3C	Always encode — HTML injection risk
=	Equals	%3D	Reserved — separates key=value pairs. Encode in values.
>	Greater Than	%3E	Always encode — HTML injection risk
?	Question Mark	%3F	Reserved — starts query string. Encode in data.
@	At Sign	%40	Reserved — separates user@host. Encode in data.
[	Open Bracket	%5B	Reserved for IPv6 addresses
\\	Backslash	%5C	Not valid in URLs — always encode
]	Close Bracket	%5D	Reserved for IPv6 addresses
^	Caret	%5E	Unsafe — always encode
`	Backtick	%60	Unsafe — always encode
{	Open Brace	%7B	Unsafe — always encode
|	Pipe	%7C	Unsafe — always encode
}	Close Brace	%7D	Unsafe — always encode
~	Tilde	%7E	Unreserved — never needs encoding

Characters That Never Need Encoding

RFC 3986 defines these as unreserved characters — they are safe to use anywhere in a URL without encoding:

• Letters: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z (uppercase and lowercase)
• Digits: 0 1 2 3 4 5 6 7 8 9
• Four special characters: hyphen (-), underscore (_), period (.), tilde (~)

Everything else — every other character including spaces, symbols, and non-ASCII characters — should be percent-encoded when used as data in a URL.

Reserved vs Unreserved — The Core Rule

URL encoding rules come down to one question: is this character being used as a delimiter (its reserved meaning) or as data?

Category	Characters	Rule
Unreserved	A-Z a-z 0-9 - _ . ~	Never encode. These are always safe.
Reserved (delimiters)	: / ? # [ ] @ ! $ & \' ( ) * + , ; =	Do NOT encode when used as URL structure (path separator, query marker, etc.)
Reserved (as data)	Same characters as above	MUST encode when the character appears inside a data value (query parameter value, path segment data)
Unsafe / Other	space " < > { } | \\ ^ ` and all non-ASCII	Always encode. These characters are never valid in raw URLs.

Example: In https://example.com/search?q=tom&jerry, the & is a delimiter separating query parameters. But if the search term is literally "tom&jerry" (one value), the & must be encoded: ?q=tom%26jerry.

Non-ASCII Characters (Unicode, Emoji, Accents)

Characters outside the ASCII range — accented letters (e, u), Chinese/Japanese/Korean characters, emoji — are encoded by first converting to UTF-8 bytes, then percent-encoding each byte.

• e (e-acute) → UTF-8 bytes: C3 A9 → URL encoded: %C3%A9
• u (u-umlaut) → UTF-8 bytes: C3 BC → URL encoded: %C3%BC
• Emoji can produce 4+ encoded segments since they are 4 bytes in UTF-8

Modern browsers display the decoded characters in the address bar for readability, but the actual HTTP request uses the percent-encoded form.

URL Encoding in Different Programming Languages

Every language handles URL encoding slightly differently. Here is the correct function to use in each:

Language	Encode Function	Encodes Spaces As	Notes
JavaScript	encodeURIComponent()	%20	Encodes everything except A-Z a-z 0-9 - _ . ! ~ * \' ( )
Python 3	urllib.parse.quote()	%20	Use quote_plus() if you need + for spaces (form encoding)
Java	URLEncoder.encode()	+ (plus)	Returns + for spaces. Replace + with %20 if needed for path encoding.
C#	HttpUtility.UrlEncode()	+ (plus)	Use Uri.EscapeDataString() for %20 instead of +
PHP	urlencode()	+ (plus)	Use rawurlencode() for %20 instead of +
Go	url.QueryEscape()	+ (plus)	Use url.PathEscape() for %20 instead of +
Ruby	CGI.escape()	+ (plus)	Use ERB::Util.url_encode() for %20

Notice the pattern: most languages default to + for spaces (form encoding). If you need %20 (path encoding), look for the "raw" or "component" variant of the function.

Common URL Encoding Mistakes

• Double encoding: Encoding an already-encoded string turns %20 into %2520. If you see %25 in your URLs, you are encoding twice.
• Encoding the entire URL: Only encode the data values in a URL, not the structure. https%3A%2F%2F is wrong — the :// and / are structural delimiters, not data.
• Using + in the URL path: In the path portion of a URL, + is a literal plus sign, not a space. /search/hello+world means "hello+world", not "hello world". Use %20 in paths.
• Forgetting to encode #: The hash character starts a URL fragment. If your data contains #, it will silently truncate the URL at that point unless encoded as %23.
• Not encoding & in values: An unencoded & in a query value will be interpreted as a parameter separator, splitting your value into two broken parameters.

Pair These Tools Together

• URL Encoder Decoder — encode and decode URLs instantly
• HTML Entities Encoder — encode special characters for HTML
• Base64 Encoder Decoder — convert data to and from Base64
• JWT Decoder — decode JSON Web Tokens to inspect payloads
• JSON Formatter — format and validate JSON data
• Regex Tester — test patterns for extracting or matching encoded strings
• Diff Checker — compare encoded vs decoded versions of a URL
• Find & Replace — bulk replace encoded characters in text
• Password Generator — generate passwords, then URL-encode them for API auth strings

Honest Limitations

This cheat sheet covers standard URL encoding per RFC 3986. Some APIs and platforms have additional encoding requirements — for example, OAuth 1.0 requires encoding of all characters except unreserved ones using uppercase hex digits. Amazon S3 URLs have specific encoding rules for object keys. Always check the specific API documentation for edge cases beyond the standard.