When to URL Encode
URLs have a restricted character set. Characters like spaces, ampersands, equals signs, and most non-ASCII characters must be percent-encoded before being included in a URL. For example, a space becomes %20 and & becomes %26. Failing to encode these characters results in malformed URLs that servers misinterpret or reject.
This is critical when constructing query strings dynamically — if a query parameter value contains an &, the server will think it's the start of the next parameter. Always encode parameter values before concatenating them into URL strings. In code, use encodeURIComponent() for parameter values and encodeURI() for full URLs.
Common use cases: encoding redirect URLs passed as query parameters (the inner URL must be fully encoded), building OAuth authorization URLs, constructing search query strings, and encoding non-ASCII characters (like Japanese or Arabic text) for web addresses.
Tips
- Use
encodeURIComponent()for values, notencodeURI()— the latter doesn't encode&,=, and?which are needed in values. - Never manually concatenate URL parameters. Use
URLSearchParamsin JavaScript — it handles encoding automatically. - Double-encoding is a common bug: encoding an already-encoded value.
%2520is a double-encoded space. - Spaces can be encoded as
%20(URL encoding) or+(form encoding). They're not interchangeable in all contexts.