Percent-encoding table
One table that answers the question you actually have: is this character safe in a URL, and if not, what does it become? Every ASCII character with its %XX code, its RFC 3986 class, and — the part most references leave out — whether encodeURI and encodeURIComponent actually escape it. Filter by name, code, or class.
Encode any string
How to use
- Type in the Filter box to narrow the table — it matches the character, its name, its class, its decimal or hex code, and its percent code.
- Use Show to jump straight to the set you care about: everything
encodeURIComponentescapes, the unreserved characters that are always safe, or just the delimiters. - Read the encodeURI and encodeURIComponent columns to see which JavaScript function does what you want. "kept" means the character passes through unchanged.
- Paste anything into Encode any string to get its per-character codepoints and UTF-8 percent-encoding — this handles non-ASCII too.
Reserved, unreserved, and the ones nobody classifies
RFC 3986 splits characters into three groups. Unreserved (A–Z a–z 0–9 - . _ ~) are always safe anywhere. Reserved characters carry structural meaning and split into gen-delims (: / ? # [ ] @), which separate the major parts of a URL, and sub-delims (! $ & ' ( ) * + , ; =), which separate things inside a part. Everything else — space, quotes, angle brackets, backslash, braces, pipe, caret, backtick, and every control character — has no legal unescaped use and must be percent-encoded.
The practical rule: encode a whole URL with encodeURI, which leaves the delimiters intact so the URL keeps working. Encode a value you are inserting with encodeURIComponent, which escapes the delimiters too so a & in your value cannot turn into a parameter separator. The four characters ! ' ( ) * are a known gap: they are reserved sub-delims that encodeURIComponent leaves alone, which is why some APIs need them escaped by hand.
FAQ
Why is a space sometimes %20 and sometimes +?
%20 is the URL encoding of a space and is valid anywhere. + means space only in application/x-www-form-urlencoded data — form submissions and query strings written by form-encoding libraries. In a path, + is a literal plus sign. If you are unsure, use %20: it is correct in both contexts.
Do I need to encode non-ASCII characters like é or 日?
In a path or query, yes — encode them as UTF-8 bytes, so é becomes %C3%A9. Browsers display the readable form but send the encoded bytes. In a hostname the rule is different: non-ASCII gets converted to Punycode instead, which the Punycode converter does.
Is ~ safe? Older references say to encode it.
It is safe. RFC 2396 (1998) listed ~ as "unsafe"; RFC 3986 (2005) moved it into the unreserved set, and encodeURIComponent follows the newer rule. Encoding it to %7E is still legal — just unnecessary, and it makes URLs that should be identical look different.
Why does the table show two hex bytes for some characters?
Only in the Encode any string section, and only for non-ASCII input: one UTF-8 character can be two to four bytes, and each byte gets its own %XX. All 128 ASCII characters are single-byte.