%2D is the URL-encoded hyphen (-).
In a URL, %2D stands for the hyphen (-). It never needs encoding — Here is when to encode it, what it does in each part of a URL, and what every major language outputs.
Quick facts
| Character | - |
|---|---|
| Name | Hyphen (minus) |
| Unicode | U+002D |
| UTF-8 bytes | 2D (1 byte) |
| Percent-encoded | %2D |
| Lowercase form | %2d — identical meaning |
| Double-encoded | %252D |
| HTML form encoding | - |
| RFC 3986 class | Unreserved |
What it means in a URL
The hyphen is unreserved: it never needs encoding, and every correct encoder leaves it alone. %2D is a valid but unnecessary spelling, and RFC 3986 says it should be normalised back to -.
RFC 3986 class: Unreserved. It never needs encoding; the encoded form is valid but should be normalised back to the plain character.
When to encode it
| Where it appears | What to do |
|---|---|
| Path segment | Leave as-is |
| Query value | Leave as-is |
| Fragment | Leave as-is |
| Form body | Leave as-is |
The mistake to watch for
Proofpoint v2 links use - in place of %, so a real hyphen in the original address appears as -2D.
What each language produces
Left as-is by JavaScript encodeURIComponent(s), JavaScript encodeURI(s), JavaScript URLSearchParams, Python urllib.parse.quote(s), Python quote(s, safe=""), Python urllib.parse.quote_plus(s), PHP rawurlencode($s), PHP urlencode($s), Java URLEncoder.encode(s, UTF_8), Go url.QueryEscape(s), Go url.PathEscape(s), Ruby URI.encode_www_form_component(s), Ruby ERB::Util.url_encode(s), C# / .NET Uri.EscapeDataString(s); every other function in the table encodes it. Output for the single character, UTF-8 input, tested against the real runtimes (see the encoding comparator for your own strings).
| Function | Output | |
|---|---|---|
| JavaScript encodeURIComponent(s) | - | kept |
| JavaScript encodeURI(s) | - | kept |
| JavaScript URLSearchParams | - | kept |
| Python urllib.parse.quote(s) | - | kept |
| Python quote(s, safe="") | - | kept |
| Python urllib.parse.quote_plus(s) | - | kept |
| PHP rawurlencode($s) | - | kept |
| PHP urlencode($s) | - | kept |
| Java URLEncoder.encode(s, UTF_8) | - | kept |
| Go url.QueryEscape(s) | - | kept |
| Go url.PathEscape(s) | - | kept |
| Ruby URI.encode_www_form_component(s) | - | kept |
| Ruby ERB::Util.url_encode(s) | - | kept |
| C# / .NET Uri.EscapeDataString(s) | - | kept |
Decoding it
decodeURIComponent('%2D') returns the hyphen (-). Python: urllib.parse.unquote('%2D'); PHP: rawurldecode('%2D'). Paste any string into the URL decoder to decode it in your browser.
Common questions.
%2D is the percent-encoded form of the hyphen (-), whose byte value is 0x2D. Decoding the URL turns it back into the character.
Yes. Hex digits in percent-encoding are case-insensitive, so %2d and %2D mean the same thing. RFC 3986 recommends uppercase, and mixing cases can make caches and analytics count one URL as two.
No. Hyphen (minus) is an unreserved character in RFC 3986, so it can appear anywhere in a URL as-is.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Character classes follow RFC 3986 §2; language outputs were generated by running each function in its real runtime.