Encode URLs and special characters. Fast, secure, and completely free. All processing happens in your browser — no data is sent to any server.
URL encoding (percent-encoding) replaces characters that aren't safe inside a URL — spaces, &, =, #, and non-ASCII characters — with a % followed by their hexadecimal byte value, so the URL can be transmitted without ambiguity between the browser, the server, and every proxy in between. A space becomes %20, an ampersand inside a query value becomes %26, and so on. Without this, a query string containing a literal & inside one of its values would be misread as the start of a new parameter, silently corrupting the request.
Any time a value you don't fully control — a search term, a filename, a piece of user-generated text — needs to become part of a URL, it needs percent-encoding first, or the request can break in ways that are hard to diagnose: a query parameter silently truncated at an unescaped &, a redirect URL that loses its trailing path because of an unescaped #, or a file download that 404s because a space in the filename split the URL. Encoding by hand is easy to get wrong for edge cases like +, which means a literal space in a query string but not in a path segment.
encodeURI leaves reserved URL characters like &, =, and / untouched because it assumes you're encoding a whole URL; encodeURIComponent escapes those characters too, since it assumes you're encoding a single value that will be placed inside a URL (like a query parameter).
%20 is the standard percent-encoding for a space in a URL path or query component. A literal + is sometimes used to mean 'space' specifically inside application/x-www-form-urlencoded form bodies, which is a different, older convention.
No — encode only the parts that come from user input or dynamic values, like a query parameter or path segment. Encoding the protocol or domain would break the URL.
Correct encoding of untrusted input before it's inserted into a URL helps prevent certain injection issues, but it's one layer among several — always validate and sanitize input on the server too.
You get double-encoding — a % becomes %25, and decoding once won't fully recover the original. Always check whether a value is already encoded before encoding it again.