%40 in a URL

The percent-encoded at sign (@).

Short answer

%40 is the percent-encoded at sign (@). In a URL, @ separates credentials from the host (user:password@host), so an @ inside a value, such as an email address or a password, is encoded as %40.

Character: @
Percent-encoded: %40
Byte value: 0x40 = 64
RFC 3986 class: gen-delim
UTF-8 bytes: 1

Where you will see it

Email addresses in query values: email=jane%40example.com.
Passwords in connection strings: postgres://user:p%40ss@db.example.com/app.
Output of encodeURIComponent, which encodes @ while escape() leaves it alone.

What goes wrong

A password that contains @ must be encoded as %40 inside a connection URL. Otherwise the parser splits at the wrong @ and reads part of the password as the host name.
Encode only the password, not the whole URL: the @ that separates credentials from the host must stay as a real @.

Decoded examples

Encoded	Decodes to	What it is	Open in the decoder
email=jane%40example.com	email=jane@example.com	An email address in a query parameter.	Open in decoder
p%40ss%3Aw0rd	p@ss:w0rd	A password containing @ and a colon.	Open in decoder

How each language encodes `@`

Outputs below come from running each function, not from documentation. “Kept” means the function leaves the character as it is. Compare every character across every function.

Language	Function	Output for @
JavaScript	encodeURIComponent	%40
JavaScript	encodeURI	kept
JavaScript	URLSearchParams	%40
JavaScript	escape (deprecated)	kept
Python	quote (default safe='/')	%40
Python	quote (safe='')	%40
Python	quote_plus	%40
C#	Uri.EscapeDataString	%40
C#	WebUtility.UrlEncode	%40
C#	HttpUtility.UrlEncode	%40

Questions

How do I put @ in a database password in a URL?

Percent-encode the password before building the connection URL: encodeURIComponent in JavaScript, quote(password, safe='') in Python. @ becomes %40, and the real @ before the host stays.

Why is @ allowed in some parts of a URL and not others?

In the authority part, @ is the delimiter between userinfo and host. In a path or query it is a legal data character, though encoding it avoids ambiguity.

Decode or encode your own text

Paste anything containing %40. It runs in your browser; nothing is uploaded.

URL Decoder URL Encoder

Related characters

%3A

colon

%3A is the percent-encoded colon (:).

%2F

forward slash

%2F is the percent-encoded forward slash (/).

%2C

comma

%2C is the percent-encoded comma (,).

All percent-encoded characters · Full percent-encoding table · What is URL encoding?

Behaviour checked against RFC 3986, the WHATWG URL Standard and MDN. Updated November 4, 2026

URL Encoder

Percent-encode a value, a full URL or form data, with strict RFC 3986 and +/%20 options.

URL Parser

Split a URL into scheme, host, port, path, query and fragment, with checks for common problems.

Query String Parser

Edit query parameters as a table, rebuild the string, or export it as JSON.

Base64 Encode/Decode

Convert text to Base64 and back, including the URL-safe Base64URL alphabet.

HTML Encode/Decode

Escape text to HTML entities and decode entities back to text.

JWT Decoder

Read a JSON Web Token's header and payload and check its expiry.