%5C is the URL-encoded backslash (\).
In a URL, %5C stands for the backslash (\). Here is when to encode it, what it does in each part of a URL, and what every major language outputs.
Quick facts
| Character | \ |
|---|---|
| Name | Backslash |
| Unicode | U+005C |
| UTF-8 bytes | 5C (1 byte) |
| Percent-encoded | %5C |
| Lowercase form | %5c — identical meaning |
| Double-encoded | %255C |
| HTML form encoding | %5C |
| RFC 3986 class | Not allowed in URLs |
What it means in a URL
The backslash is not allowed in URLs and is encoded as %5C. Browsers treat a raw backslash in http(s) URLs as a forward slash, which is a known source of open-redirect and path-confusion bugs.
RFC 3986 class: Not allowed in URLs. It is outside the characters RFC 3986 permits, so it must always be percent-encoded.
When to encode it
| Where it appears | What to do |
|---|---|
| Path segment | Encode |
| Query value | Encode |
| Fragment | Encode |
| Form body | Encode |
The mistake to watch for
Allow-lists that check for //evil.example but miss /\evil.example, which browsers also treat as a protocol-relative URL.
What each language produces
Every function in this table encodes it. Output for the single character, UTF-8 input, tested against the real runtimes (see the encoding comparator for your own strings).
| Function | Output | |
|---|---|---|
| JavaScript encodeURIComponent(s) | %5C | encoded |
| JavaScript encodeURI(s) | %5C | encoded |
| JavaScript URLSearchParams | %5C | encoded |
| Python urllib.parse.quote(s) | %5C | encoded |
| Python quote(s, safe="") | %5C | encoded |
| Python urllib.parse.quote_plus(s) | %5C | encoded |
| PHP rawurlencode($s) | %5C | encoded |
| PHP urlencode($s) | %5C | encoded |
| Java URLEncoder.encode(s, UTF_8) | %5C | encoded |
| Go url.QueryEscape(s) | %5C | encoded |
| Go url.PathEscape(s) | %5C | encoded |
| Ruby URI.encode_www_form_component(s) | %5C | encoded |
| Ruby ERB::Util.url_encode(s) | %5C | encoded |
| C# / .NET Uri.EscapeDataString(s) | %5C | encoded |
Decoding it
decodeURIComponent('%5C') returns the backslash (\). Python: urllib.parse.unquote('%5C'); PHP: rawurldecode('%5C'). Paste any string into the URL decoder to decode it in your browser.
← %5B Left square bracket · Full URL encoding table · %5D Right square bracket →
Common questions.
%5C is the percent-encoded form of the backslash (\), whose byte value is 0x5C. Decoding the URL turns it back into the character.
Yes. Hex digits in percent-encoding are case-insensitive, so %5c and %5C mean the same thing. RFC 3986 recommends uppercase, and mixing cases can make caches and analytics count one URL as two.
Use your language’s encoder on the value: encodeURIComponent in JavaScript gives %5C, Python’s quote(s, safe="") gives %5C, PHP’s rawurlencode gives %5C.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Character classes follow RFC 3986 §2; language outputs were generated by running each function in its real runtime.