%0A is the URL-encoded line feed.
In a URL, %0A stands for the line feed. Here is when to encode it, what it does in each part of a URL, and what every major language outputs.
Quick facts
| Character | LF (invisible) |
|---|---|
| Name | Line feed (newline, LF) |
| Unicode | U+000A |
| UTF-8 bytes | 0A (1 byte) |
| Percent-encoded | %0A |
| Lowercase form | %0a — identical meaning |
| Double-encoded | %250A |
| HTML form encoding | %0A |
| RFC 3986 class | Not allowed in URLs |
What it means in a URL
A line feed is a control character, encoded as %0A. It appears legitimately in multi-line form fields; anywhere else it is a warning sign.
RFC 3986 class: Not allowed in URLs. It is outside the characters RFC 3986 permits, so it must always be percent-encoded.
When to encode it
| Where it appears | What to do |
|---|---|
| Path segment | Encode |
| Query value | Encode |
| Fragment | Encode |
| Form body | Encode |
The mistake to watch for
CRLF injection: %0D%0A in a value that is copied into an HTTP header lets an attacker add headers. Strip or reject control characters after decoding.
What each language produces
Every function in this table encodes it. Output for the single character, UTF-8 input, tested against the real runtimes (see the encoding comparator for your own strings).
| Function | Output | |
|---|---|---|
| JavaScript encodeURIComponent(s) | %0A | encoded |
| JavaScript encodeURI(s) | %0A | encoded |
| JavaScript URLSearchParams | %0A | encoded |
| Python urllib.parse.quote(s) | %0A | encoded |
| Python quote(s, safe="") | %0A | encoded |
| Python urllib.parse.quote_plus(s) | %0A | encoded |
| PHP rawurlencode($s) | %0A | encoded |
| PHP urlencode($s) | %0A | encoded |
| Java URLEncoder.encode(s, UTF_8) | %0A | encoded |
| Go url.QueryEscape(s) | %0A | encoded |
| Go url.PathEscape(s) | %0A | encoded |
| Ruby URI.encode_www_form_component(s) | %0A | encoded |
| Ruby ERB::Util.url_encode(s) | %0A | encoded |
| C# / .NET Uri.EscapeDataString(s) | %0A | encoded |
Decoding it
decodeURIComponent('%0A') returns the line feed. Python: urllib.parse.unquote('%0A'); PHP: rawurldecode('%0A'). Paste any string into the URL decoder to decode it in your browser.
← %7E Tilde · Full URL encoding table · %0D Carriage return (CR) →
Common questions.
%0A is the percent-encoded form of the line feed, whose byte value is 0x0A. Decoding the URL turns it back into the character.
Yes. Hex digits in percent-encoding are case-insensitive, so %0a and %0A mean the same thing. RFC 3986 recommends uppercase, and mixing cases can make caches and analytics count one URL as two.
Use your language’s encoder on the value: encodeURIComponent in JavaScript gives %0A, Python’s quote(s, safe="") gives %0A, PHP’s rawurlencode gives %0A.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Character classes follow RFC 3986 §2; language outputs were generated by running each function in its real runtime.