%5F is the URL-encoded underscore (_).
In a URL, %5F stands for the underscore (_). It never needs encoding — Here is when to encode it, what it does in each part of a URL, and what every major language outputs.
Quick facts
| Character | _ |
|---|---|
| Name | Underscore |
| Unicode | U+005F |
| UTF-8 bytes | 5F (1 byte) |
| Percent-encoded | %5F |
| Lowercase form | %5f — identical meaning |
| Double-encoded | %255F |
| HTML form encoding | _ |
| RFC 3986 class | Unreserved |
What it means in a URL
The underscore is unreserved and never needs encoding. Proofpoint v2 links reuse it to stand for /, so https-3A__ means https://.
RFC 3986 class: Unreserved. It never needs encoding; the encoded form is valid but should be normalised back to the plain character.
When to encode it
| Where it appears | What to do |
|---|---|
| Path segment | Leave as-is |
| Query value | Leave as-is |
| Fragment | Leave as-is |
| Form body | Leave as-is |
The mistake to watch for
Assuming %5F and _ are different keys — after decoding they are identical.
What each language produces
Left as-is by JavaScript encodeURIComponent(s), JavaScript encodeURI(s), JavaScript URLSearchParams, Python urllib.parse.quote(s), Python quote(s, safe=""), Python urllib.parse.quote_plus(s), PHP rawurlencode($s), PHP urlencode($s), Java URLEncoder.encode(s, UTF_8), Go url.QueryEscape(s), Go url.PathEscape(s), Ruby URI.encode_www_form_component(s), Ruby ERB::Util.url_encode(s), C# / .NET Uri.EscapeDataString(s); every other function in the table encodes it. Output for the single character, UTF-8 input, tested against the real runtimes (see the encoding comparator for your own strings).
| Function | Output | |
|---|---|---|
| JavaScript encodeURIComponent(s) | _ | kept |
| JavaScript encodeURI(s) | _ | kept |
| JavaScript URLSearchParams | _ | kept |
| Python urllib.parse.quote(s) | _ | kept |
| Python quote(s, safe="") | _ | kept |
| Python urllib.parse.quote_plus(s) | _ | kept |
| PHP rawurlencode($s) | _ | kept |
| PHP urlencode($s) | _ | kept |
| Java URLEncoder.encode(s, UTF_8) | _ | kept |
| Go url.QueryEscape(s) | _ | kept |
| Go url.PathEscape(s) | _ | kept |
| Ruby URI.encode_www_form_component(s) | _ | kept |
| Ruby ERB::Util.url_encode(s) | _ | kept |
| C# / .NET Uri.EscapeDataString(s) | _ | kept |
Decoding it
decodeURIComponent('%5F') returns the underscore (_). Python: urllib.parse.unquote('%5F'); PHP: rawurldecode('%5F'). Paste any string into the URL decoder to decode it in your browser.
← %5E Caret · Full URL encoding table · %60 Backtick (grave accent) →
Common questions.
%5F is the percent-encoded form of the underscore (_), whose byte value is 0x5F. Decoding the URL turns it back into the character.
Yes. Hex digits in percent-encoding are case-insensitive, so %5f and %5F mean the same thing. RFC 3986 recommends uppercase, and mixing cases can make caches and analytics count one URL as two.
No. Underscore is an unreserved character in RFC 3986, so it can appear anywhere in a URL as-is.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Character classes follow RFC 3986 §2; language outputs were generated by running each function in its real runtime.