%0A is a line feed
%0A is a line feed — the invisible character that ends one line and starts the next in Unix-style text.
| Character | (Line Feed) |
|---|---|
| Name | Line Feed |
| Encoded | %0A |
| Reserved | No |
Why it breaks things
A line feed, U+000A, is what ends a line in Unix, Linux and most modern text files. On its own it carries no meaning inside a URL, but it turns up constantly in text that was never meant to become one line: a multi-line address, a paragraph, a block of code copied out of an editor.
Verified in Node with new URL(): a raw line feed sitting inside a URL is deleted during parsing, not encoded. new URL("https://example.com/path[LF]/next") produces the path /path/next, with no trace that a line break was ever there — the two halves are simply joined.
Not every path through a URL treats it that way, though. A value set through URLSearchParams, the mechanism a web form uses, percent-encodes a line feed to %0A properly instead of deleting it — verified with .searchParams.set(). It is specifically a raw line feed already sitting in an assembled URL string that gets silently deleted.
Real examples
Without encoding
https://example.com/contact?address=123 Main St[LF]Apt 4
With encoding
https://example.com/contact?address=123%20Main%20St%0AApt%204
[LF] stands in for a real line feed, copied from a two-line address in a spreadsheet or text file. Pasted raw into an address bar it is deleted during parsing, joining "St" and "Apt" with no space. Built through a form or URLSearchParams instead, it is percent-encoded to %0A correctly, and both lines survive.
Without encoding
https://example.com/paste?snippet=first line[LF]second line
With encoding
https://example.com/paste?snippet=first%20line%0Asecond%20line
A snippet copied out of a terminal or a text file, line ending included. The encoded form preserves the line break as data inside the value; a raw line feed left in an already-built URL string would instead be deleted by a WHATWG-compliant parser before the request is even sent.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Does a browser turn a line feed into %0A automatically?
- It depends how the line feed gets there. A value typed into a form field and submitted normally is percent-encoded to %0A. A raw line feed already sitting in an assembled URL string is deleted outright when the URL is parsed, not encoded.
- Why did pasting a two-line address into a URL join the lines together with no space?
- The line feed between them was deleted during URL parsing, per the WHATWG URL Standard, leaving the text on either side pushed directly together.
- Is this the same character used in CRLF injection?
- It is half of it. A line feed paired with a carriage return, %0D%0A, is the sequence used in CRLF injection and HTTP response splitting — see %0D for that story specifically.
- How does a line feed usually end up in a URL by accident?
- Most often from pasting multi-line text — an address, a note, a code snippet — out of a spreadsheet, a terminal or a text editor into a single-line field that ends up in a URL.