What URL encoding does
A URL may only contain a limited set of ASCII characters, and some of them – ? & = / # + – give the URL its structure. Percent-encoding (RFC 3986) writes every other byte as a percent sign followed by two hexadecimal digits, so that a value can be put into a URL without changing its meaning. Characters outside ASCII are first converted to their UTF-8 bytes: ü becomes %C3%BC.
Examples
a b&cbecomesa%20b%26cas a URL component anda+b%26cas form data.MünchenbecomesM%C3%BCnchen.q=base64%20decodedecodes toq=base64 decode.
URL component or form data?
Use URL component for a path segment or a single query value. It escapes the same characters as JavaScript's encodeURIComponent, plus ! ' ( ) *. Use form data for application/x-www-form-urlencoded request bodies and for query strings built by HTML forms, where + means a space. When decoding, that is the only difference: in form mode a + turns into a space, as a URL component it stays a plus sign.
Encode a whole URL?
Encode the parts, not the whole URL. Encoding https://example.com/?q=1 as one component also escapes the :, the / and the ?. That is right for a URL passed as a parameter of another URL, such as a redirect target, but not for a link that should still open.
URL encoding is not base64: to put binary data into a URL, use the URL-safe variant of the base64 encoder. Tokens in URLs are often JSON Web Tokens, which the JWT decoder reads.