URL Encoder

The encoder works like JavaScript's encodeURIComponent. It leaves letters, digits and these marks unchanged: hyphen, underscore, full stop, tilde, asterisk, apostrophe, both parentheses and the exclamation mark. Everything else becomes a percent sign and two hex digits per byte:

Because :, /, ?, & and = are all encoded, pasting a complete address breaks it. The sample https://example.com/search?q=hello world&lang=en comes out as https%3A%2F%2Fexample.com%2Fsearch%3Fq%3Dhello%20world%26lang%3Den, which no browser will open as a link.

That output is right when the whole URL is itself a parameter value, such as a redirect target. Otherwise, encode each value on its own and assemble the URL around it. For a search term Tom & Jerry, encode just that, get Tom%20%26%20Jerry, and build ?q=Tom%20%26%20Jerry. Left unencoded, the & would start a new parameter.

Spaces become %20, never +. HTML forms send spaces as + in query strings, but %20 is valid everywhere, so you don't need to change it. A literal plus sign is encoded as %2B. That matters for phone numbers like +44 and for Base64 values, which would otherwise be read as spaces on the server.

Non-ASCII characters are encoded as their UTF-8 bytes, one %XX per byte:

• café → caf%C3%A9
• €5 → %E2%82%AC5
• 🙂 → %F0%9F%99%82

Encoding is not idempotent. Run already-encoded text through again and every % becomes %25: %20 turns into %2520, and the receiving server sees a literal "%20" instead of a space. Before encoding, check whether your value already contains %XX sequences. Many frameworks and HTTP libraries encode query parameters for you, so encoding by hand first is a common cause of this bug.