URL Encoding Cheat Sheet: Characters, Languages, and Quick Reference

This is the URL encoding reference you can bookmark and come back to. It covers the most common characters and their percent-codes, the right encoding function in each major language, and a few rules to keep in mind when building URLs programmatically.

Common Characters and Their Percent-Codes

Character	Name	Encoded	Notes
Space	Space	%20	Or + in form encoding
!	Exclamation	%21	Safe in some encoders
"	Double quote	%22
#	Hash/pound	%23	Starts fragment if unencoded
%	Percent	%25	Must encode to avoid double-encoding
&	Ampersand	%26	Separates params if unencoded
'	Apostrophe	%27	Safe in some encoders
(	Open paren	%28	Safe in some encoders
)	Close paren	%29	Safe in some encoders
+	Plus	%2B	Decoded as space in form encoding
,	Comma	%2C
/	Slash	%2F	Separates path if unencoded
:	Colon	%3A
;	Semicolon	%3B
=	Equals	%3D	Separates key/value if unencoded
?	Question mark	%3F	Starts query string if unencoded
@	At sign	%40	Separates user info if unencoded
[	Open bracket	%5B
]	Close bracket	%5D

Always-safe characters (never need encoding): A–Z a–z 0–9 - _ . ~

Sell Custom Apparel — We Handle Printing & Free Shipping

Encoding Syntax in Every Major Language

Language	Function	Space output
JavaScript	encodeURIComponent(str)	%20
Python	urllib.parse.quote(str, safe='')	%20
Python (forms)	urllib.parse.quote_plus(str)	+
Java	URLEncoder.encode(str, UTF_8)	+
C#	Uri.EscapeDataString(str)	%20
PHP	rawurlencode($str)	%20
PHP (forms)	urlencode($str)	+
Ruby	URI.encode_www_form_component(str)	+
Go	url.QueryEscape(str)	+
Bash	python3 -c "import urllib.parse; print(urllib.parse.quote('str'))"	%20

Five Rules That Prevent Most URL Encoding Bugs

• Encode values, not structure. Only encode the data inside parameters — not slashes, question marks, or equals signs that form the URL structure.
• Encode exactly once. If you encode an already-encoded string, %20 becomes %2520. Always start from the raw value.
• Match the decoder. If you encode with + for spaces, make sure the receiver decodes + as space. Use %20 when in doubt — it's unambiguous.
• Use library functions. Don't build query strings with string concatenation. Use URLSearchParams, urllib.parse.urlencode(), or your HTTP library's params argument — they handle encoding for you.
• Non-ASCII uses UTF-8 first. Accented letters, emoji, and CJK characters are converted to UTF-8 bytes first, then each byte is percent-encoded. Language functions handle this automatically.

Frequently Asked Questions

What characters are safe to use in a URL without encoding?

Unreserved characters (RFC 3986): A–Z, a–z, 0–9, hyphen (-), underscore (_), period (.), tilde (~). These never need encoding anywhere in a URL.

Does URL encoding change the length of a string?

Yes, almost always longer. Each non-ASCII or reserved character becomes at least 3 characters (%XX). Emoji become 12 characters (%XX%XX%XX%XX). The encoded string can be several times longer than the original for international text.

Is there a maximum length for a URL?

There is no official maximum in the RFC specifications, but practical limits exist. Most browsers handle URLs up to ~2,000 characters. Many servers and CDNs reject URLs over 8,192 bytes. For very long parameter values, consider POST instead of GET.

Should I URL encode a full URL that I'm passing as a query parameter?

Yes — if the URL is a value inside another URL's query string, encode it completely including its slashes, colons, and question marks. encodeURIComponent() does this correctly. The outer URL structure remains intact; the inner URL becomes an opaque encoded value.