URL Encode/Decode

URL (percent) encoding replaces any character a URL isn't allowed to contain literally — spaces, &, #, +, non-ASCII letters — with a % followed by its two-digit hex byte value, so it can safely travel inside a query string, path segment, or full address without being misread as part of the URL's own structure. Decoding reverses that: every %XX sequence turns back into the byte it represents.

JavaScript actually gives you two different functions for this, and picking the wrong one is a common bug source. encodeURIComponent() escapes everything unsafe, including &, =, and / — use it for a single value going into a query parameter, like a search term or a redirect target. encodeURI() assumes you're encoding an entire URL and deliberately leaves & = / : ? # alone, since those are meant to keep their structural role — use it only when you have a whole URL, not a single field. Mixing them up is exactly how a query parameter containing an & ends up silently splitting into two parameters.

• •Default to Component mode for anything going into a single query parameter or path segment — Full URL mode intentionally leaves & = / ? # unescaped, which breaks a parameter value that itself contains those characters.
• •A + in a query string traditionally means a space (from the older application/x-www-form-urlencoded convention) — but encodeURIComponent() always uses %20 for spaces, never +. If you're decoding a classic form submission, replace + with a space before percent-decoding.
• •Encode each value separately before assembling a URL, rather than building the full URL string first and encoding it once — encoding a complete URL with encodeURIComponent() would also escape the :// and / you need to keep.
• •A stray % not followed by two valid hex digits is the most common decode failure — it usually means the text was already decoded once, or wasn't URL-encoded to begin with.