How it works
URL encoding (percent-encoding) replaces characters that cannot appear literally in an address with %XX sequences carrying their byte value. For example, a space becomes %20.
The "Component" scope also escapes the reserved characters (= & / ? #): use it for a parameter's value. "Full URL" preserves the address structure: use it for a whole URL.
In HTML forms the space is encoded as + (application/x-www-form-urlencoded); in all other cases %20 is used, per the RFC 3986 standard.
Examples
hola mundo & máshola%20mundo%20%26%20m%C3%A1sThe "&" is escaped (%26) so it is not confused with a parameter separator; "á" is encoded in UTF-8 (%C3%A1).a=1&b=2a%3D1%26b%3D2https://sitio.com/á b?x=1 2URL completa: https://sitio.com/%C3%A1%20b?x=1%202In "Full URL" mode, ://, /, and ? are preserved; only what would break the address is escaped.Use cases
- Build query parameters safely when constructing a URL by hand.
- Encode values that contain &, =, spaces, or accents before sending them in a GET request.
- Decode a URL to read what values each parameter carries.
- Prepare application/x-www-form-urlencoded bodies for form submission.
Frequently asked questions
What is the difference between "Component" and "Full URL"?
"Component" (encodeURIComponent) also escapes =, &, /, ?, # — it is for an individual value. "Full URL" (encodeURI) preserves those structural characters — it is for a whole URL.
When is + used and when %20 for a space?
The + only applies to the body of forms (application/x-www-form-urlencoded). In the rest of the URL, the standard for the space is %20.
Why does "á" become %C3%A1 and not a single %XX?
Because it is encoded in UTF-8: non-ASCII characters take several bytes, and each byte is represented by its own %XX sequence.
Does encoding a URL make it secure?
No. It only makes it valid at the syntax level. It is not encryption and does not protect the content in any way.