Master URI syntax rules, query string serialization, handling spaces (%20 vs +), and preventing URL injection vulnerabilities across web APIs.
Developer Tools technical reference asset
Uniform Resource Identifiers (URIs) and URLs are the addressing system of the World Wide Web. However, because URLs must travel across diverse legacy networking hardware, routers, and proxies, the URI specification strictly limits permitted characters to a small subset of US-ASCII.
Percent-encoding (often called URL encoding) represents arbitrary characters—including spaces, symbols, and non-Latin Unicode text—using safe, universally parsable triplets of a percent sign `%` followed by two hexadecimal digits.
The internet protocol suite was built when 7-bit ASCII was standard. Characters outside the US-ASCII printable range (such as emojis or accented letters like `é` or `ñ`), as well as control characters (tabs, newlines), cannot be transmitted directly in raw URL strings.
Furthermore, certain characters (like `?`, `&`, `/`, and `#`) carry reserved structural meanings in URI grammar. If a user searches for `"salt&pepper"`, the `&` must be encoded so the server does not misinterpret it as a query parameter separator.
RFC 3986 divides the ASCII character set into two distinct categories:
| Category | Character Set | Encoding Requirement |
|---|---|---|
| Unreserved Characters | `A-Z`, `a-z`, `0-9`, `-`, `_`, `.`, `~` | Never encoded. Safe anywhere in a URI. |
| Reserved (Gen-Delims) | `: / ? # [ ] @` | Must be encoded when used as raw data payload. |
| Reserved (Sub-Delims) | `! $ & ' ( ) * + , ; =` | Must be encoded when used as raw data payload. |
When encoding non-ASCII characters, the character is first converted to its UTF-8 byte representation. Each resulting byte is then written as `%` followed by two uppercase hexadecimal digits.
For example, the Euro symbol `€` is represented in UTF-8 as three bytes: `0xE2 0x82 0xAC`. When URL-encoded, `€` becomes `%E2%82%AC`.
In JavaScript, developers frequently confuse `encodeURI` with `encodeURIComponent`:
A frequent source of confusion is why spaces are sometimes encoded as `%20` and other times as `+`.
In standard RFC 3986 URI paths, a space MUST be encoded as `%20`. In legacy HTML `application/x-www-form-urlencoded` query strings (derived from early HTML form submissions), spaces are conventionally encoded as `+`. Modern web APIs prefer `%20` everywhere for strict RFC compliance.
Rather than manually concatenating strings with template literals, always use the native `URL` and `URLSearchParams` browser APIs. They automatically handle correct percent-encoding, parameter escaping, and array serialization out of the box.
Mastering RFC 3986 percent-encoding rules ensures reliable parameter transmission across web browsers, REST APIs, and search engines.
Encode, decode, parse, and debug complex URL strings instantly with Softnag’s in-browser URL Encoder & Decoder.
Try these free in-browser utilities mentioned in this guide
Encode special characters into percent-encoded query parameters or decode encoded URLs into clean text.
Break down complex URLs into protocol, hostname, port, pathname, hash, and interactive query parameters.
Encode text and binary files to Base64 format or decode Base64 data back into plaintext and files.
A technical breakdown of RFC 8259 JSON serialization: trailing commas, character escaping rules, JSON Schema validation, and zero-server in-browser formatting.
A deep dive into Base64 (RFC 4648): 6-bit chunking mathematics, padding with "=", binary Data URLs for images, and calculating network payload overhead.
A technical exploration of cryptographic hashes: the avalanche effect, pigeonhole principle, Merkle-Damgård construction, and SHA-256 algorithms.