URL encoder
Percent-encoding shown three ways at once, because a space is %20 in one place and + in another — and the string a+b decodes to two different things depending on where in a URL it sat. Nothing you type here leaves your browser — it is worked out on your own device, so there is nothing to send and nothing to log.
A space is %20 or +, and both are correct
In a URL path, a space must be %20. In form-encoded data — the format a browser submits a form in, and what most query strings actually are — it is +.
That is not a legacy quirk to be tidied away. Form encoding is a
separate specification, application/x-www-form-urlencoded,
that happens to live inside a URL. So the string
a+b decodes to "a b" if it came from a
query string and "a+b" if it came from a path, and
nothing about the string itself tells you which.
This page shows you both, and decodes both ways when they differ.
Three functions, three jobs
encodeURIComponent escapes everything reserved, so it is right for a single value you are dropping into a URL. encodeURI leaves the structural characters alone, so it is right for a whole URL you already built. Using the second where you needed the first is how an & inside a value silently becomes a new parameter.
That failure is quiet, common, and occasionally a security problem.
A broken escape cannot be guessed at
A % must be followed by two hexadecimal digits.
%ZZ is not decodable, and there is no reasonable
recovery: this page says so rather than dropping the character or
passing it through, either of which would be inventing data on your
behalf.