Encoding and escaping

Encoding is not a security measure and it is not compression. It is a translation, and it is always reversible by anyone — that is the entire point. Base64 takes arbitrary bytes and rewrites them using 64 characters that survive email, RFC 4648 being the specification that pins down the alphabet and the padding. Percent-encoding does the same job for URLs under RFC 3986, replacing anything with structural meaning by a % and two hex digits. Hex is the same idea again with sixteen characters instead of sixty-four.

The confusion worth clearing up first is the one that causes incidents: an encoded string looks scrambled, so it gets treated as though it were protected. It is not. Anyone can decode it, in one line, with no key — and the fact that it takes a tool rather than the naked eye is not a meaningful obstacle. Encoding changes the alphabet. Encryption changes who can read it. Hashing throws information away deliberately so nobody can get it back. Three different jobs that produce three similar-looking strings.

The second confusion is subtler and produces silent bugs rather than loud ones. The browser's own btoa predates widespread UTF-8 and works one byte at a time, so a string containing an accented character encodes to something that decodes back perfectly in your own code and wrongly everywhere else. The modern answer is to turn text into bytes deliberately with TextEncoder before encoding anything, rather than letting a default guess for you.

The same shape of mistake appears in URLs, where encodeURI and encodeURIComponent look interchangeable, escape different character sets, and only disagree once a value happens to contain an ampersand. Query strings make it worse by following a different rule from the rest of the URL: the WHATWG URL Standard decodes + as a space there and nowhere else, which is why a value that survives the path arrives mangled in the query.

None of this is difficult, but almost all of it is invisible until it breaks in a system you do not control. If you have a string in front of you now and want to know what it really holds, Base64 to Text decodes it and tells you which alphabet it used, and URL Parser splits a URL into its parts so you can see what was encoded and what was not.