%40 is an at sign
%40 is an at sign.
| Character | "@" |
|---|---|
| Name | At Sign |
| Encoded | %40 |
| Reserved | Yes — it has a special meaning in a URL |
Why it breaks things
An at sign separates login information from the host in a URL's authority section. In https://user:[email protected], everything before the last @ is read as a username and password; everything after is the host the request is actually sent to. This format predates the modern web and is rarely used for real logins now, but browsers still parse it.
That rule is exactly what phishing links abuse. A URL like https://[email protected] is read as username example.com at host evil.com — the browser connects to evil.com, and example.com is never contacted. It looks safe because the eye lands on the familiar domain first, before the @ that actually decides where the browser goes.
The everyday, non-malicious version is an email address in a query value, like [email protected]. An @ there has no special meaning — it is well past the authority section by the time the parser reaches the query string, so it is read literally by nearly every server. Encoding it as %40 is still good practice, mainly so the value behaves the same wherever it ends up later.
Real examples
Without encoding
https://[email protected]/reset-password
With encoding
https://evil.com/reset-password
Everything before the last @ is read as a username, not part of the address. The browser connects to evil.com; example.com is never contacted. This exact shape is a known phishing pattern, because the real destination is easy to miss at a glance.
Without encoding
https://example.com/[email protected]
With encoding
https://example.com/signup?email=ben%40boost.co.nz
An @ inside a query value has no special meaning and is read literally by nearly every server. Encoding it anyway is standard practice — it costs nothing and removes any doubt if the value is later reused somewhere an @ would matter, like the authority section of a different URL.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Is a link like https://[email protected] actually dangerous?
- Yes. It navigates to evil.com, not example.com. Everything before the last @ is treated as login information, not the address, so the domain that looks familiar is not where the browser actually goes.
- Do I need to encode @ in an email address inside a query string?
- Not strictly — @ has no special meaning in a query value, only in the authority section before it. Encoding it is standard practice anyway, and functions like encodeURIComponent do it automatically.
- What is 'userinfo' in a URL?
- It is the optional username and password that can appear before an @ in the authority section, as in https://user:[email protected]. It is a legacy way to pass credentials in the URL itself and is not recommended for real logins today.
- Why do browsers sometimes warn me about a URL with an @ in it?
- Because of the phishing pattern above. Some browsers flag or specially display URLs that contain userinfo, since a domain placed before the @ can be mistaken for the actual destination.