Canonicalization reduces an encoded string to its simplest, equivalent form. For example, %41 (URL encoding) canonicalizes to 'A'. This is crucial for security because attackers can use multiple encodings to bypass filters - canonicalization reveals the true input.