URL Encoding Guide: Percent-Encoding Query Strings and Parameters

URLs can contain paths, query parameters, fragments, separators, Unicode text, and characters that have special meaning. When arbitrary text is inserted into one of those components, it often needs percent-encoding, commonly called URL encoding.

Encoding the right component prevents malformed URLs and subtle application bugs.

What percent-encoding looks like

Percent-encoding represents a byte using % followed by hexadecimal digits.

For example, a space may appear as %20 in an encoded URL component.

Other characters can also be encoded when they are unsafe or ambiguous in a particular URL context.

Use Duck Cloud's URL Encoder to percent-encode a URL component locally, and the URL Decoder to inspect encoded text.

Encode components, not an entire URL blindly

A complete URL contains syntax that should remain meaningful:

https://example.com/search?q=duck cloud&sort=new

Characters such as :, /, ?, =, and & act as separators.

If you blindly encode the entire URL as one component, you may encode the separators and destroy the URL structure.

Instead, encode the dynamic value being inserted.

For example, encode the query value duck cloud, then place that result after q=.

Query strings are a common source of bugs

Consider a search value:

cloud & security

If the ampersand is inserted without encoding, a server may interpret it as the beginning of another query parameter.

Encoding the parameter value keeps the text as data instead of allowing it to become URL syntax.

The same principle applies to values containing:

• &;
• =;
• ?;
• #;
• spaces;
• non-ASCII text;
• emoji.

Spaces: %20 and plus signs

In URL components, %20 is the common percent-encoded representation of a space.

HTML form encoding has additional conventions where a plus sign may represent a space in form data. That is one reason developers should use the correct URL or form API instead of manually replacing characters.

Unicode and UTF-8

International text must be converted to bytes before percent-encoding.

Modern web applications typically use UTF-8. A Burmese, Japanese, Arabic, or emoji character can require multiple bytes, producing multiple percent-encoded sequences.

When debugging, decode the component with the URL Decoder and compare the result with the exact original text.

Avoid double encoding

Double encoding happens when already encoded text is encoded again.

For example, the % in %20 can itself become %25, producing a sequence such as %2520.

Signs of double encoding include:

• %25 appearing unexpectedly;
• routes failing only after redirects;
• query values still containing %20 after one decode;
• signatures failing because the encoded form changed.

Track where encoding occurs in the application and make each layer responsible for it only once.

URL encoding is not encryption

Like Base64, URL encoding does not hide secrets.

A token placed in a URL may be stored in:

• browser history;
• server logs;
• analytics;
• referrer data;
• screenshots;
• monitoring systems.

Do not assume percent-encoded credentials are protected.

Common application cases

Search parameters

Encode user-entered search text before inserting it into a query value.

Callback URLs

OAuth and authentication flows often include one URL inside another URL. Nested values need careful component-level encoding.

File names

File names containing spaces or international characters may need encoding when they become path components.

API filters

Structured filters placed in query strings can contain reserved characters and need correct serialization.

Debugging checklist

1. Identify the exact URL component that contains dynamic data.
2. Encode only that component.
3. Inspect the final URL.
4. Decode the value once and compare it with the expected original.
5. Look for %25 when double encoding is suspected.
6. Do not store secrets in URLs merely because they are encoded.
7. Use standard URL APIs in your programming language whenever possible.

Duck Cloud's URL Encoder and URL Decoder are useful for quick inspection, but application code should rely on maintained platform URL APIs for production serialization.