application/x-www-form-urlencoded
applicationThe default encoding for HTML form submissions (method=POST without enctype attribute). Key-value pairs encoded like URL query strings: key1=val1&key2=val2 with percent-encoding for special characters. Cannot transmit binary data or files – use multipart/form-data for file uploads.
Details
application/x-www-form-urlencoded is the default Content-Type for HTML <form> POST submissions. Keys and values are percent-encoded (URL-encoded) and joined with &.
Encoding rules: - Spaces encoded as + or %20 - Special chars percent-encoded: @ → %40, / → %2F - Key-value pairs: key=value&key2=value2
When to use: - HTML form submissions without file uploads - OAuth 2.0 token endpoint requests (POST /oauth/token requires this) - Legacy API endpoints that predate JSON APIs
When NOT to use: - File uploads (use multipart/form-data) - Binary data (use application/octet-stream or multipart/form-data) - Large payloads (use application/json)
OAuth 2.0: RFC 6749 §4.1.3 requires the token request body to be application/x-www-form-urlencoded. This is one reason you still encounter this type in modern auth flows.
Common use
HTML form submissions, OAuth 2.0 token requests, legacy API endpoints
Security note
Never put sensitive data (passwords, tokens) in URL query strings. x-www-form-urlencoded in the request body is safe (HTTPS encrypted), but data may appear in server logs if accidentally placed in the URL.