What is URL encoding?
Percent encoding lets a URL carry bytes that would otherwise be ambiguous, unsafe, or unavailable in its text form. An encoded byte appears as % followed by two hexadecimal digits, such as %20 for a space.
Encoding must be applied to the correct URL component. A query value, path segment, and complete URL do not share exactly the same safe character set.
Reserved and unreserved characters
Letters, digits, hyphen, period, underscore, and tilde are generally unreserved. Characters such as :, /, ?, #, [, ], and @ help define URL structure. Query syntax also gives special meaning to & and =.
If user data contains a reserved character, encode it as data so it cannot be mistaken for syntax.
Spaces, plus signs, and Unicode
General URI percent encoding represents a space as %20. HTML form query encoding commonly uses + for a space, which means a literal plus sign must be encoded as %2B.
Non-ASCII text is normally converted to UTF-8 bytes before each byte is percent-encoded. Decoder and encoder must agree on the character encoding.
encodeURI versus encodeURIComponent
encodeURI('https://example.test/search?q=hello world');
// https://example.test/search?q=hello%20world
encodeURIComponent('hello world & more');
// hello%20world%20%26%20moreencodeURI leaves URL separators intact. encodeURIComponent is the safer default for an individual dynamic value because it encodes separators that could split or alter that value.
Encoding a query parameter
Value
hello worldEncoded component
hello%20worldUse the URL Encoder / Decoder to encode the value, then append it through a URL API or query builder rather than concatenating untrusted values into a complete URL.
Decode percent-encoded text safely
Decode only the component that was encoded. Repeated decoding can turn intended data into syntax and may create security problems in routers or filters. Treat decoded data as untrusted input and validate it for its final use.
Percent encoding and Base64 encoding solve different transport problems; neither is encryption.