URL Encode & Decode

A URL may only contain a limited set of ASCII characters. RFC 3986, the 2005 specification for URI syntax, splits them into two groups. The unreserved characters, A–Z, a–z, 0–9 and the four marks - . _ ~, never need encoding. The reserved characters have jobs: the general delimiters : / ? # [ ] @ separate scheme, host, path, query and fragment, and the sub-delimiters ! $ & ' ( ) * + , ; = separate items within them, as & and = do in a query string. Everything else, and any reserved character used as plain data, must be percent-encoded.

Percent-encoding writes a byte as % followed by two hexadecimal digits. Text is first converted to UTF-8, so a space becomes %20, an é (two bytes) becomes %C3%A9 and an emoji becomes four %XX groups. That is why a search for "café & bar" ends up in a link as caf%C3%A9%20%26%20bar: the & is encoded so the server does not read it as the start of a new parameter.

encodeURIComponent is the right choice for a single piece, such as a query value, a path segment or a redirect URL passed as a parameter. It escapes everything except the unreserved characters and ! ' ( ) *, which JavaScript leaves alone for historical reasons. encodeURI (whole URL) assumes its input is already a complete address and keeps the reserved characters intact, so https://example.com/a b?q=1 only has its space encoded. Using encodeURI on a parameter value is a classic bug: an & or # inside the value would survive and break the URL.

Decode reverses either function. HTML forms submitted with GET use the older application/x-www-form-urlencoded format, in which a space is written as + rather than %20; keep Treat + as a space ticked for those, and untick it when a literal plus sign matters, as in a phone number. If the input contains a % that is not followed by two hex digits, or bytes that are not valid UTF-8, decoding fails with a clear message instead of guessing. When the text contains a query string, its parameters appear decoded in a table below the tool. For binary data in URLs, Base64url is the usual alternative.