Percent-encoding of each UTF-8 byte (%20, %C3%A9) and decoding, for URL parts, whole URLs and form data.
Procedure
How it works
A web address may only contain a few characters: letters, digits and some signs. Others, and signs that have a meaning in the URL (such as ?, & and = in a query), are written as a % followed by the two hex digits of a byte: a space is %20, & is %26. A character outside ASCII is first encoded in UTF-8 and every byte gets its own %: é is C3 A9, so %C3%A9.
Which characters may stay depends on where the text goes. RFC 3986 keeps only letters, digits and - . _ ~ (the unreserved characters). JavaScript’s encodeURIComponent also keeps ! ’ ( ) *, and encodeURI, meant for a whole address, keeps the separators : / ? # & = too. HTML forms (application/x-www-form-urlencoded) write a space as +.
Decoding replaces every %XX by its byte and reads the bytes as UTF-8. A % that is not followed by two hex digits is an error, and so are bytes that are not valid UTF-8.
Everything is calculated in your browser. Nothing you type leaves your device.