%2A is the URL-encoded asterisk (*).
In a URL, %2A stands for the asterisk (*). Here is when to encode it, what it does in each part of a URL, and what every major language outputs.
Quick facts
| Character | * |
|---|---|
| Name | Asterisk |
| Unicode | U+002A |
| UTF-8 bytes | 2A (1 byte) |
| Percent-encoded | %2A |
| Lowercase form | %2a — identical meaning |
| Double-encoded | %252A |
| HTML form encoding | * |
| RFC 3986 class | Reserved — sub-delimiter |
What it means in a URL
The asterisk is a sub-delimiter. Form encoding keeps it raw, and so do encodeURIComponent, Java and Ruby’s form encoder; PHP, Python, Go and C# write %2A. Proofpoint’s v3 links use * as a placeholder for removed characters.
RFC 3986 class: Reserved — sub-delimiter. RFC 3986 allows it raw in paths and queries, but some schemes and servers give it meaning, so encoding it as data is the safe choice.
When to encode it
| Where it appears | What to do |
|---|---|
| Path segment | Allowed raw (encoding is also fine) |
| Query value | Allowed raw (encoding is also fine) |
| Fragment | Allowed raw |
| Form body | Leave as-is |
The mistake to watch for
Signed requests: AWS SigV4 requires * as %2A, so a signature computed with Java’s URLEncoder or encodeURIComponent needs a fix-up.
What each language produces
Left as-is by JavaScript encodeURIComponent(s), JavaScript encodeURI(s), JavaScript URLSearchParams, Java URLEncoder.encode(s, UTF_8), Ruby URI.encode_www_form_component(s); every other function in the table encodes it. Output for the single character, UTF-8 input, tested against the real runtimes (see the encoding comparator for your own strings).
| Function | Output | |
|---|---|---|
| JavaScript encodeURIComponent(s) | * | kept |
| JavaScript encodeURI(s) | * | kept |
| JavaScript URLSearchParams | * | kept |
| Python urllib.parse.quote(s) | %2A | encoded |
| Python quote(s, safe="") | %2A | encoded |
| Python urllib.parse.quote_plus(s) | %2A | encoded |
| PHP rawurlencode($s) | %2A | encoded |
| PHP urlencode($s) | %2A | encoded |
| Java URLEncoder.encode(s, UTF_8) | * | kept |
| Go url.QueryEscape(s) | %2A | encoded |
| Go url.PathEscape(s) | %2A | encoded |
| Ruby URI.encode_www_form_component(s) | * | kept |
| Ruby ERB::Util.url_encode(s) | %2A | encoded |
| C# / .NET Uri.EscapeDataString(s) | %2A | encoded |
Decoding it
decodeURIComponent('%2A') returns the asterisk (*). Python: urllib.parse.unquote('%2A'); PHP: rawurldecode('%2A'). Paste any string into the URL decoder to decode it in your browser.
← %29 Right parenthesis · Full URL encoding table · %2B Plus sign →
Common questions.
%2A is the percent-encoded form of the asterisk (*), whose byte value is 0x2A. Decoding the URL turns it back into the character.
Yes. Hex digits in percent-encoding are case-insensitive, so %2a and %2A mean the same thing. RFC 3986 recommends uppercase, and mixing cases can make caches and analytics count one URL as two.
Use your language’s encoder on the value: encodeURIComponent in JavaScript gives *, Python’s quote(s, safe="") gives %2A, PHP’s rawurlencode gives %2A.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Character classes follow RFC 3986 §2; language outputs were generated by running each function in its real runtime.