Why addresses show %20 and %C3%A9

A URL can hold only a small set of characters: letters, digits and a few symbols. Everything else, spaces, accented letters, emoji, is first turned into UTF-8 bytes and then each byte is written as % followed by two hexadecimal digits. A space becomes %20, é becomes %C3%A9.

Some characters carry structure: / separates path segments, ? opens the query string, & separates parameters, = separates name and value, # introduces the fragment. Inside a value they must be encoded, or they break the address. That is the difference between encodeURIComponent, which encodes them, and encodeURI, which leaves them because it works on a whole URL.

In web forms and query strings a space is also often written as +. That is why decoding here turns + into a space, as servers do; in a path, though, + stays a plus.

Common mistakes

  • Using encodeURI for a parameter value: an & in the value splits the parameter in two.
  • Encoding twice: %20 becomes %2520 and the server receives the literal text %20.
  • Building a URL by concatenating unencoded strings: besides the errors, it opens the door to parameter injection.

Frequently asked questions

What is the difference between encodeURI and encodeURIComponent?

encodeURIComponent encodes everything except letters, digits and - _ . ! ~ * ' ( ): it is for a single value. encodeURI also leaves : / ? # [ ] @ & = + $ , ;: it is for an address already put together.

Why is a space sometimes %20 and sometimes +?

%20 is the general encoding of a space in a URL. The + comes from HTML forms (application/x-www-form-urlencoded) and means a space only in the query string.

What is Punycode?

It is how domains with non-ASCII characters, like münchen.de, are written in DNS: xn--mnchen-3ya.de. The browser shows the readable form but uses the encoded one underneath.

How this calculation works

Encoding: the text is turned into UTF-8 bytes and every byte outside the allowed set becomes %HH, where HH is the byte's hexadecimal value. encodeURIComponent allows only A–Z a–z 0–9 - _ . ! ~ * ' ( ); encodeURI also allows ; , / ? : @ & = + $ #. Decoding: each %HH goes back to its byte, the bytes are read as UTF-8 and + becomes a space.