URL Encoder / Decoder

Characters that carry structural meaning in a URL — spaces, ampersands, question marks, slashes, anything non-ASCII — have to be percent-escaped before they can sit inside a query string or path, and this converts them in both directions. It comes up whenever a value is being assembled into a link by hand: a search term with spaces, a redirect target passed as a parameter, a filename with accented characters, or a signed value being debugged. The single most useful rule is to encode individual parameter values rather than a whole assembled URL, because encoding the complete address escapes the very `?` and `&` that give it structure and produces a link that no longer works. Decoding a string that was never encoded is harmless, but decoding twice can corrupt values that legitimately contain a percent sign, so decode once and check the result. Both directions run in the page, so a URL carrying a token is never sent to a third-party site.