URL Encode Percent Sign (%)

The percent sign (%) is the escape character in URL encoding itself. Every percent-encoded sequence starts with % followed by two hexadecimal digits (e.g., %20, %3F). When a literal percent sign needs to appear in a URL, it must be encoded as %25 to distinguish it from the start of an encoded sequence.

Percent-encoded form: %25 represents the percent sign (ASCII code 37, hexadecimal 0x25). This is the encoding of the encoding character itself, making it unique among all URL-encoded characters.

Why this is special: Since % signals the beginning of an encoded triplet, an unencoded % in a URL creates ambiguity. If a URL contains 100%done, the parser may try to interpret %do as an encoded character, fail (because do is not valid hexadecimal), and either throw an error or produce garbled output depending on the implementation.

JavaScript behavior:

encodeURIComponent("100%")    // "100%25"
encodeURIComponent("50% off") // "50%25%20off"
decodeURIComponent("100%25")  // "100%"

// Common error: decoding a string with bare %
decodeURIComponent("100%done") // throws URIError: URI malformed

The double-encoding connection: The percent sign is directly related to the double-encoding problem. If you encode a string that is already encoded, every % in the encoded string gets re-encoded to %25. For example, hello%20world becomes hello%2520world. When decoded once, you get hello%20world instead of hello world. This is the classic double-encoding bug.

Common scenarios:

• Displaying discount percentages in URLs (e.g., 50% off)
• Passing already-encoded URLs as parameter values (the % in %20 needs re-encoding)
• Mathematical or statistical expressions containing %
• File names containing % (rare but possible)

Pitfall: The decodeURIComponent() function throws a URIError if it encounters a bare % that is not followed by two valid hex digits. Always wrap decode calls in try-catch blocks, especially when processing user input or external data.