%2C is a comma
%2C is a comma.
| Character | "," |
|---|---|
| Name | Comma |
| Encoded | %2C |
| Reserved | Yes — it has a special meaning in a URL |
Why it breaks things
A comma is one of the characters the URL standard calls a sub-delimiter, alongside things like ! and ; — reserved for a scheme to give meaning to if it wants, with no universal job of its own. Unlike a query string's & and =, which the URL convention itself defines, nothing tells a server to treat a comma as a divider. Most servers pass a raw comma straight through unchanged.
The risk shows up one level up, in how a particular API reads a value. Many accept comma-separated lists in one parameter — coordinates as lat,lng, tags as tag=red,summer,sale, ids as ids=104,205,309. The URL layer does not stop a comma being taken literally, so if one item in that list has its own comma, it is indistinguishable from the list's separator, and the API silently splits one item into two.
A place name shows this clearly: Wellington, New Zealand used as a single location value looks, to a comma-splitting API, like two values. The same happens to a reference written with a thousands separator, like 12,345, when the API expects a comma-separated list. Encoding the comma as %2C makes the intent explicit.
Real examples
Without encoding
https://example.com/map?location=Wellington, New Zealand
With encoding
https://example.com/map?location=Wellington%2C%20New%20Zealand
The map API expects location as a single comma-separated lat,lng pair. A raw comma inside a place name is read as that same divider, so Wellington and New Zealand arrive as if they were two separate coordinate values.
Without encoding
https://example.com/invoices?ref=12,345
With encoding
https://example.com/invoices?ref=12%2C345
This API treats ref as a comma-separated list of invoice numbers. A single reference written with a thousands-separator comma, like 12,345, is read as two references, 12 and 345, instead of one.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Do I need to percent-encode every comma in a URL?
- No. A comma has no meaning in the URL standard itself, so most values with a raw comma are passed through unchanged. It only matters once a specific API decides to treat a comma as a list separator — encode it if a single value might contain one.
- Why did my tag list end up with more tags than I typed?
- One of your tags probably had a comma in it. An API that splits a value on commas cannot tell the difference between your intended separator and a comma that was meant to be part of one entry.
- Is a comma the same kind of character as & or =?
- The URL standard groups all three as sub-delimiters, but only & and = are given a job by the query-string convention itself — & between parameters, = between a name and its value. A comma's meaning, if it has one, is invented entirely by whatever API receives it.
- How do I know if an API treats commas as a separator?
- Check its documentation for comma-separated examples, like ids=1,2,3. If a value you are sending might contain a real comma of its own and you are not sure how the API handles it, encoding it as %2C is the safer choice.