In more detail
In a URL, characters such as ?, &, =, # and / have jobs, and spaces and non-ASCII letters are not allowed at all. To include them as data, each is converted to its UTF-8 bytes and each byte is written as % plus two hexadecimal digits. A space becomes %20, & becomes %26 and é becomes %C3%A9. The % sign itself is written %25. In older form-encoded query strings a space may appear as + instead.
Why it matters
Unencoded special characters silently change the meaning of a URL: an & in a value ends the value, and a # cuts off the rest of the address. Encoding the data correctly prevents broken links, lost parameters and some injection bugs. Decoding the wrong number of times has the opposite effect, turning %2520 into %20 instead of a space.
Example
café au lait encodes to caf%C3%A9%20au%20lait. Use the URL Encode and URL Decode to convert text in either direction.
Common confusion
Percent-encoding is not encryption and hides nothing; anyone can decode it. It is also different from Base64, which has its own alphabet and is not designed for URLs unless the URL-safe variant is used.