URL encoding is a way to represent special characters in a web address using percent-escaped bytes, such as %2F for / or %20 for a space. Browsers, proxies, web filters, and applications use it to move requests safely across the web without confusing reserved characters with normal text.
In cyber security, URL encoding matters because different layers may decode or normalize a request at different times. Attackers can abuse that gap to hide dangerous paths, parameters, or payloads from a WAF while the backend application still interprets them. Defenders should test how reverse proxies, WAFs, and apps handle encoded input, normalize requests consistently, and log both raw and decoded forms. Encoding is not malicious by itself, but inconsistent decoding can turn it into a common bypass technique.