Guide · Updated 2026-07-29
URL Encoding Basics for Query Strings
Why spaces become %20, when to encodeURIComponent, and how to debug broken redirects without guessing.
URLs are structured text
A URL is not a free-form sentence. Characters like `?`, `&`, `=`, and `#` split the address into components. If those characters appear inside a value, they must be percent-encoded or the parser will misread the structure.
Spaces are especially common in search terms and file names. Encoding turns them into `%20` (or `+` in some form encodings) so the server receives one coherent parameter.
Non-ASCII letters also need encoding for safe transport across systems that historically assumed ASCII.
encodeURIComponent vs encodeURI
In JavaScript, `encodeURIComponent` is the usual choice for a single query value or path segment you control. It encodes the reserved characters that would otherwise break parameter parsing.
`encodeURI` is gentler and aimed at whole URLs; it leaves structural characters intact. Encoding an entire URL with `encodeURIComponent` is a common mistake that escapes `://` and `?` you still need.
DevKit's URL tool follows the `encodeURIComponent` / `decodeURIComponent` pair for everyday parameter work.
Debugging checklist
When a redirect or OAuth callback fails, decode the suspicious segment first and read the plain text. Fix the value, then re-encode before rebuilding the URL.
Watch for double encoding (`%253A` instead of `%3A`). That usually means something encoded an already-encoded string.
Log both the raw and decoded forms during development so you can see whether the bug is in construction or in the receiver.
Practical habit
Encode values at the boundary where you assemble the URL, not scattered through business logic. Centralizing that step prevents mixed raw/encoded bags of parameters.
Prefer well-tested URL builders in application code for production systems; use a browser tool for quick inspection and learning.
This article explains tooling mechanics only — it is not legal or security advice for handling credentials in URLs (avoid putting secrets in query strings when you can).
Ready to try it? Open URL encode tool