Component, full URL or form?
Component (encodeURIComponent) escapes everything except letters, digits and - _ . ! ~ * ' ( ). Use it for a single query value or path segment — it encodes & = ? / # so they cannot break the URL structure. This is the right choice most of the time.
Full URL (encodeURI) leaves the characters that give a URL its structure — : / ? # [ ] @ & = + $ , ; — untouched, and only escapes spaces, non-ASCII and a few unsafe characters. Use it on a whole URL you already trust. Form encoding is component encoding with spaces written as +, matching how browsers submit HTML forms.
Frequently asked questions
Should a space be %20 or +?
%20 is correct everywhere in a URL. + means space only in query strings using form encoding; in a path, + is a literal plus sign. When in doubt, use %20.
Why is é encoded as %C3%A9?
URLs carry bytes. é is two bytes in UTF-8 (C3 A9), and each byte becomes %XX. The explainer shows this for any character.
Which characters never need encoding?
The RFC 3986 "unreserved" set: A–Z, a–z, 0–9, hyphen, underscore, period and tilde.
Is URL encoding a security measure?
No. It keeps URLs well-formed; it does not hide or protect data. Anyone can decode it.