encodeURIComponent versus encodeURI
JavaScript has two built-in encoders, and choosing the wrong one is the most common URL bug. Take the text https://example.com/a b?x=1&y=2:
encodeURIgiveshttps://example.com/a%20b?x=1&y=2. It keeps the characters that give a URL its structure (: / ? # & =and a few more) and only fixes what is not allowed, such as the space. Use it on a complete address.encodeURIComponentgiveshttps%3A%2F%2Fexample.com%2Fa%20b%3Fx%3D1%26y%3D2. It encodes everything that could be mistaken for structure. Use it on one piece of data, such as a query value or a path segment.
The rule of thumb: if the text is going into a URL as data, use the single value style. If the text is the URL, use the whole URL style. Encoding a complete URL with the single value style breaks it, and putting a raw URL inside another URL's query breaks that URL.
How percent-encoding works
A URL may only contain a small set of characters. Anything else is written as a percent sign followed by the two hex digits of each byte. A space is the byte 20, so it becomes %20. Characters outside ASCII are first turned into UTF-8 bytes, so é (two bytes) becomes %C3%A9, and an emoji such as 👋 (four bytes) becomes %F0%9F%91%8B.
Letters, digits and the four characters - _ . ~ never need encoding. Characters such as : / ? # [ ] @ ! $ & ' ( ) * + , ; = have a job in URLs, so they must be encoded when they appear as data rather than as structure.
Spaces: %20 or +
Both mean a space, but in different places. %20 works everywhere in a URL. The + form comes from HTML forms (application/x-www-form-urlencoded) and is only valid in a query string. In a path, + is a real plus sign.
To send a real plus sign in a query value, write %2B. A phone number such as +1 555 becomes %2B1%20555, or %2B1+555 in form style.
Reading a query string
The Parse a URL view splits an address into scheme, host, port, path, query and fragment, then lists each parameter with its decoded key and value. The text as typed is shown underneath when it differs, so you can see exactly what the server receives.
Keys that appear more than once are flagged. Servers and frameworks disagree about them: some keep the first value, some the last and some collect a list. The JSON copy shows them as lists.