%26 is an ampersand
%26 is an ampersand.
| Character | "&" |
|---|---|
| Name | Ampersand |
| Encoded | %26 |
| Reserved | Yes — it has a special meaning in a URL |
Why it breaks things
In a query string, an ampersand separates one parameter from the next. After the first ?, a URL like ?a=1&b=2 is read as key=value pairs joined by &, and the parser splits the string at every & it finds. It has no way to tell an intentional divider from an & that is meant to be part of a value.
This is why company names and titles break query strings so often. A value like AT&T looks like one piece of text to a person, but a URL parser reads it as two parameters: name=AT and a second, empty parameter called T. The rest of the name is gone, and a parameter nobody asked for has appeared in its place. The same thing happens to Marks & Spencer, Fish & Chips, or Tom & Jerry, unless the & is written as %26.
In HTML source, & is written as &, because a raw & begins a character reference, like © — that is an HTML rule, not a URL rule. An href attribute can need both at once: %26 for the URL's own ampersand, and & because that URL sits inside HTML text. Confusing the two is a common source of double-escaped links.
Real examples
Without encoding
https://example.com/companies?name=AT&T
With encoding
https://example.com/companies?name=AT%26T
Without encoding, the query is read as two parameters: name=AT and an empty parameter called T. The company name arrives as just 'AT', with 'T' added as a meaningless extra parameter.
Without encoding
https://example.com/login?next=https://example.com/account?tab=billing&ref=email
With encoding
https://example.com/login?next=https%3A%2F%2Fexample.com%2Faccount%3Ftab%3Dbilling%26ref%3Demail
The redirect target's own ref parameter is joined with a plain &, so it is read as belonging to the login page, not the account page. The next value gets cut off at tab=billing, and ref=email becomes a new top-level parameter instead of following the user to their account.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Why did searching for a company name with an ampersand return the wrong thing?
- The ampersand split the query into two parameters partway through the name. A search for AT&T is read as name=AT plus an empty parameter called T, so the server only ever sees 'AT'.
- What is the difference between %26 and &?
- They solve different problems. %26 is how a URL encodes a literal ampersand. & is how HTML source encodes one, because a raw & in HTML text begins a character reference like ©. A link's href attribute can need both at once — %26 for the URL itself, & because that URL is sitting inside an HTML page.
- Do I need to encode & if my URL only has one parameter?
- Yes, if the value itself contains an &. The parser does not know how many parameters you intended — it just splits on every & it finds, so a lone parameter with a literal & inside it still gets cut in two.
- Is & the only way to separate query parameters?
- In practice, yes, on the modern web. Some very old systems accepted a semicolon as an alternative separator, but that was dropped from later specifications. Any literal & or ; inside a value should be encoded rather than relied on to behave as data.