URL Encode / Decode

Converts text to and from percent-encoding, so special characters survive being put in a URL, a query string, or form data without breaking the request. Comes up any time you're building a URL by hand or debugging why an API call with a weird character in it isn't parsing the way you expect.

Characters that have to be encoded

• Space → %20 (or + specifically inside form-encoded data — the two aren't interchangeable everywhere)
• & → %26 — it separates query parameters, so a literal ampersand inside a value will get misread as the start of the next parameter
• = → %3D — separates parameter name from value
• / → %2F — a path separator, so leaving it unencoded inside a path segment can change how the URL is routed
• # → %23 — starts the fragment; anything after an unencoded # gets silently dropped by the browser before the request is even sent

The bug this usually causes

Forget to encode a value going into a query string and you get requests that work fine in testing (because your test data happens not to contain &, # or +) and then silently truncate or misparse in production the first time a real user's input contains one of those characters — a search term with an ampersand in it is a classic way this surfaces.

Not the same thing as Base64

URL encoding escapes individual characters so a string is safe inside a URL. Base64 converts arbitrary binary data into text so it survives being carried somewhere that only handles text. Different problems, different tools — and neither one is encryption, so don't reach for either when what you actually need is authentication or access control.