%2F in a URL
The percent-encoded forward slash (/).
Short answer
%2F is the percent-encoded forward slash (/). It lets a value contain a slash without the slash being read as a path separator, for example when a whole URL is passed as a query parameter or an identifier contains a slash.
- Character
- /
- Percent-encoded
- %2F
- Byte value
- 0x2F = 47
- RFC 3986 class
- gen-delim
- UTF-8 bytes
- 1
Where you will see it
- URLs nested inside query parameters: redirect=https%3A%2F%2Fexample.com%2Fpath.
- Path segments whose value contains a slash: /files/ana%2Fmaria.
- Output of encodeURIComponent, which encodes / while encodeURI leaves it alone.
What goes wrong
- Many servers treat %2F in a path differently from a real slash. Apache httpd answers 404 for it by default (AllowEncodedSlashes is Off), Apache Tomcat rejects it by default, and Spring Security's default firewall blocks it. If a path segment must contain a slash, check how your stack handles it or move the value into the query string.
- Hex digits are case-insensitive, so %2f and %2F are the same byte, although RFC 3986 recommends uppercase. HttpUtility.UrlEncode in .NET writes lowercase hex.
- Python's quote keeps / by default (safe='/'), so quote('a/b') returns a/b. Pass safe='' to get a%2Fb.
Decoded examples
| Encoded | Decodes to | What it is | Open in the decoder |
|---|---|---|---|
| https%3A%2F%2Fexample.com%2Fpath | https://example.com/path | A full URL encoded to travel inside a query parameter. | Open in decoder |
| ana%2Fmaria | ana/maria | A single path segment that contains a slash. | Open in decoder |
How each language encodes /
Outputs below come from running each function, not from documentation. “Kept” means the function leaves the character as it is. Compare every character across every function.
| Language | Function | Output for / |
|---|---|---|
| JavaScript | encodeURIComponent | %2F |
| JavaScript | encodeURI | kept |
| JavaScript | URLSearchParams | %2F |
| JavaScript | escape (deprecated) | kept |
| Python | quote (default safe='/') | kept |
| Python | quote (safe='') | %2F |
| Python | quote_plus | %2F |
| C# | Uri.EscapeDataString | %2F |
| C# | WebUtility.UrlEncode | %2F |
| C# | HttpUtility.UrlEncode | %2f |
Questions
Is %2F the same as /?
They decode to the same character, but a URL parser treats them differently. A literal slash separates path segments; a %2F is data inside one segment. That is why replacing one with the other can change which resource a URL points to.
Why does my server return 404 for %2F?
Several servers and frameworks reject or normalise encoded slashes in paths for security reasons, because they can be used to bypass path checks. Apache httpd, Apache Tomcat and Spring Security all do this by default. Check your server's documentation before relying on %2F in a path.
Decode or encode your own text
Paste anything containing %2F. It runs in your browser; nothing is uploaded.
Related characters
%3A
colon
%3A is the percent-encoded colon (:).
%3F
question mark
%3F is the percent-encoded question mark (?).
%23
hash sign
%23 is the percent-encoded hash sign (#).
All percent-encoded characters · Full percent-encoding table · What is URL encoding?
Behaviour checked against RFC 3986, the WHATWG URL Standard and MDN. Updated November 4, 2026
Tools
URL Encoder
Percent-encode a value, a full URL or form data, with strict RFC 3986 and +/%20 options.
URL Parser
Split a URL into scheme, host, port, path, query and fragment, with checks for common problems.
Query String Parser
Edit query parameters as a table, rebuild the string, or export it as JSON.
Base64 Encode/Decode
Convert text to Base64 and back, including the URL-safe Base64URL alphabet.
HTML Encode/Decode
Escape text to HTML entities and decode entities back to text.
JWT Decoder
Read a JSON Web Token's header and payload and check its expiry.