%09 is the URL-encoded tab.
In a URL, %09 stands for the tab. Here is when to encode it, what it does in each part of a URL, and what every major language outputs.
Quick facts
| Character | TAB (invisible) |
|---|---|
| Name | Tab |
| Unicode | U+0009 |
| UTF-8 bytes | 09 (1 byte) |
| Percent-encoded | %09 |
| Lowercase form | %09 — identical meaning |
| Double-encoded | %2509 |
| HTML form encoding | %09 |
| RFC 3986 class | Not allowed in URLs |
What it means in a URL
A tab is a control character, encoded as %09. It usually arrives by accident when a value is copied from a spreadsheet or TSV file.
RFC 3986 class: Not allowed in URLs. It is outside the characters RFC 3986 permits, so it must always be percent-encoded.
When to encode it
| Where it appears | What to do |
|---|---|
| Path segment | Encode |
| Query value | Encode |
| Fragment | Encode |
| Form body | Encode |
The mistake to watch for
Invisible tabs copied from spreadsheets into IDs, which then fail to match even though they look identical.
What each language produces
Every function in this table encodes it. Output for the single character, UTF-8 input, tested against the real runtimes (see the encoding comparator for your own strings).
| Function | Output | |
|---|---|---|
| JavaScript encodeURIComponent(s) | %09 | encoded |
| JavaScript encodeURI(s) | %09 | encoded |
| JavaScript URLSearchParams | %09 | encoded |
| Python urllib.parse.quote(s) | %09 | encoded |
| Python quote(s, safe="") | %09 | encoded |
| Python urllib.parse.quote_plus(s) | %09 | encoded |
| PHP rawurlencode($s) | %09 | encoded |
| PHP urlencode($s) | %09 | encoded |
| Java URLEncoder.encode(s, UTF_8) | %09 | encoded |
| Go url.QueryEscape(s) | %09 | encoded |
| Go url.PathEscape(s) | %09 | encoded |
| Ruby URI.encode_www_form_component(s) | %09 | encoded |
| Ruby ERB::Util.url_encode(s) | %09 | encoded |
| C# / .NET Uri.EscapeDataString(s) | %09 | encoded |
Decoding it
decodeURIComponent('%09') returns the tab. Python: urllib.parse.unquote('%09'); PHP: rawurldecode('%09'). Paste any string into the URL decoder to decode it in your browser.
← %0D Carriage return (CR) · Full URL encoding table · %00 Null byte →
Common questions.
%09 is the percent-encoded form of the tab, whose byte value is 0x09. Decoding the URL turns it back into the character.
Yes. Hex digits in percent-encoding are case-insensitive, so %09 and %09 mean the same thing. RFC 3986 recommends uppercase, and mixing cases can make caches and analytics count one URL as two.
Use your language’s encoder on the value: encodeURIComponent in JavaScript gives %09, Python’s quote(s, safe="") gives %09, PHP’s rawurlencode gives %09.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Character classes follow RFC 3986 §2; language outputs were generated by running each function in its real runtime.