application/x-www-form-urlencoded Encoding

The application/x-www-form-urlencoded content type is the default encoding for HTML form submissions. It is closely related to URL percent encoding but has key differences, most notably that spaces are encoded as + instead of %20.

How form encoding works:

1. Each form field name and value is encoded
2. Spaces are replaced with +
3. Non-alphanumeric characters (except -, _, ., *) are percent-encoded
4. Name-value pairs are joined with =
5. Pairs are separated with &

Example:

Form fields:
  name: "John Doe"
  message: "Hello & goodbye!"

Encoded body:
  name=John+Doe&message=Hello+%26+goodbye%21

JavaScript behavior:

// URLSearchParams produces form-encoded output
const formData = new URLSearchParams({
  name: "John Doe",
  message: "Hello & goodbye!"
});
formData.toString();
// "name=John+Doe&message=Hello+%26+goodbye%21"

// fetch with form encoding
fetch("/api/submit", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: formData.toString()
});

// Versus standard URL encoding
encodeURIComponent("John Doe"); // "John%20Doe" (not form encoding)

Key differences from RFC 3986 percent encoding:

Feature	Form Encoding	RFC 3986
Spaces	+	%20
Asterisk *	Not encoded	Not encoded
Tilde ~	Encoded as %7E (legacy)	Not encoded

When form encoding is used:

• HTML <form method="GET"> submissions (data goes in the URL query string)
• HTML <form method="POST"> submissions with default enctype
• AJAX requests with Content-Type: application/x-www-form-urlencoded
• OAuth 1.0 signature base strings

When NOT to use form encoding:

• File uploads (use multipart/form-data instead)
• JSON API requests (use application/json)
• URL path segments (use standard percent encoding)

Pitfall: When a server receives query parameters, it must know whether to decode + as a space or as a literal plus sign. Query strings from HTML form GET submissions use form encoding (+ = space), but query strings constructed manually might use RFC 3986 encoding (+ = literal plus). Most server frameworks assume form encoding for query strings, so a literal + in a value should be sent as %2B.