%2E is the URL-encoded period (.).
In a URL, %2E stands for the period (.). It never needs encoding — Here is when to encode it, what it does in each part of a URL, and what every major language outputs.
Quick facts
| Character | . |
|---|---|
| Name | Period (dot) |
| Unicode | U+002E |
| UTF-8 bytes | 2E (1 byte) |
| Percent-encoded | %2E |
| Lowercase form | %2e — identical meaning |
| Double-encoded | %252E |
| HTML form encoding | . |
| RFC 3986 class | Unreserved |
What it means in a URL
The period is unreserved and is never encoded by standard encoders. Path segments of exactly . or .. are special — browsers and servers resolve them as “this directory” and “parent directory”.
RFC 3986 class: Unreserved. It never needs encoding; the encoded form is valid but should be normalised back to the plain character.
When to encode it
| Where it appears | What to do |
|---|---|
| Path segment | Leave as-is |
| Query value | Leave as-is |
| Fragment | Leave as-is |
| Form body | Leave as-is |
The mistake to watch for
Path traversal: %2e%2e/ is still ../ after decoding. Validate paths after decoding, never before.
What each language produces
Left as-is by JavaScript encodeURIComponent(s), JavaScript encodeURI(s), JavaScript URLSearchParams, Python urllib.parse.quote(s), Python quote(s, safe=""), Python urllib.parse.quote_plus(s), PHP rawurlencode($s), PHP urlencode($s), Java URLEncoder.encode(s, UTF_8), Go url.QueryEscape(s), Go url.PathEscape(s), Ruby URI.encode_www_form_component(s), Ruby ERB::Util.url_encode(s), C# / .NET Uri.EscapeDataString(s); every other function in the table encodes it. Output for the single character, UTF-8 input, tested against the real runtimes (see the encoding comparator for your own strings).
| Function | Output | |
|---|---|---|
| JavaScript encodeURIComponent(s) | . | kept |
| JavaScript encodeURI(s) | . | kept |
| JavaScript URLSearchParams | . | kept |
| Python urllib.parse.quote(s) | . | kept |
| Python quote(s, safe="") | . | kept |
| Python urllib.parse.quote_plus(s) | . | kept |
| PHP rawurlencode($s) | . | kept |
| PHP urlencode($s) | . | kept |
| Java URLEncoder.encode(s, UTF_8) | . | kept |
| Go url.QueryEscape(s) | . | kept |
| Go url.PathEscape(s) | . | kept |
| Ruby URI.encode_www_form_component(s) | . | kept |
| Ruby ERB::Util.url_encode(s) | . | kept |
| C# / .NET Uri.EscapeDataString(s) | . | kept |
Decoding it
decodeURIComponent('%2E') returns the period (.). Python: urllib.parse.unquote('%2E'); PHP: rawurldecode('%2E'). Paste any string into the URL decoder to decode it in your browser.
← %2D Hyphen (minus) · Full URL encoding table · %2F Slash (forward slash) →
Common questions.
%2E is the percent-encoded form of the period (.), whose byte value is 0x2E. Decoding the URL turns it back into the character.
Yes. Hex digits in percent-encoding are case-insensitive, so %2e and %2E mean the same thing. RFC 3986 recommends uppercase, and mixing cases can make caches and analytics count one URL as two.
No. Period (dot) is an unreserved character in RFC 3986, so it can appear anywhere in a URL as-is.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Character classes follow RFC 3986 §2; language outputs were generated by running each function in its real runtime.