Percent-encoding is a URI syntax for representing characters as hexadecimal byte values, such as %50 for P. It is commonly used in URLs to safely carry reserved characters, spaces, and other bytes that may not be valid in a raw path or query string.
In cyber security, percent-encoding matters because different systems may interpret the same request differently. A web application firewall may inspect the encoded text on the wire, while the backend server decodes it before routing the request. Attackers can abuse that gap to hide blocked paths, evade simple string rules, or reach administrative endpoints through encoded variants. Defenders should normalize requests consistently, inspect both encoded and decoded forms in logs, and avoid relying on path blocking alone.