Canonicalization is the process of reducing an encoded string to its simplest, unambiguous form by decoding all encoding layers. For security, this is crucial because attackers can use multiple encoding schemes (URL encoding, double encoding, mixed encoding) to hide malicious input. By canonicalizing input first, security checks can detect attacks regardless of the encoding used.