Percent-encoding
Percent-encoding writes a character that a URL cannot carry as itself, such as a space, an accented letter or an ampersand inside a value, as a percent sign followed by the two hexadecimal digits of each of its UTF-8 bytes. A space becomes %20 and é becomes %C3%A9.
A URL is allowed only a small set of characters. Letters, digits and a few marks can stand as themselves, and some marks, such as the slash, question mark, ampersand and hash, give the address its structure. Anything else has to be written another way, and percent-encoding is that way.
How it works
The character is turned into its UTF-8 bytes, and each byte is written as a percent sign followed by two hexadecimal digits. A space is one byte, so it becomes %20. The letter é is two bytes, so it becomes %C3%A9. A browser decodes these when it shows an address, which is why a link can look plain in the address bar and full of codes when copied.
When a structural character is data
The marks that hold a URL together need encoding when they appear inside a value. A search for “salt & pepper” has to write its ampersand as %26, or the server reads the rest as a new parameter. That is why encoding a single value and encoding a whole address are different jobs: the first escapes the structural marks, the second must leave them alone.
Reading an encoded link
A long link full of codes is easier to check once it is decoded and split into its parts. A URL parser shows the host, the path and each query parameter with its value decoded, so a tracking code, a redirect target or a token in the link can be seen for what it is.
Frequently asked questions
Why does a space sometimes become a plus sign instead of %20?
Form data, and the query strings built from it, write a space as a plus sign. That is a separate convention from percent-encoding and applies only in a query string. In a path, a plus sign is just a plus sign.
Is percent-encoding a kind of encryption?
No. Anyone can decode it, and a decoder shows the original text at once. It exists so that a URL can carry any character, not to hide what the URL says.
Why is an accented letter written as two codes?
Because the letter takes two bytes in UTF-8, and each byte gets its own percent sign and two digits. Characters from other scripts can take three or four.