URI encoding is the practice of representing reserved or non-ASCII characters in a web address using percent-encoded bytes, such as %2F for a slash. It lets browsers and servers transmit paths, queries, and parameters safely without misreading special characters as syntax.
In cyber security, URI encoding matters because attackers can abuse inconsistent decoding between proxies, web servers, and applications. A request may look harmless in one layer but resolve to a protected route in another, helping with authentication bypasses, path traversal, or filter evasion. Defenders reduce this risk by normalizing input once, using standard URL-parsing libraries, rejecting ambiguous or double-encoded data, and testing how management APIs handle edge-case encodings.