Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I stumbled upon this by accident when mistyping the URL for a web page in my web browser.

Why does visiting cause an HTTP 400 Bad Request error to be thrown? Is the server expecting something else after or before the percent sign?

It seems to happen for Apache and Nginx servers.

share|improve this question
up vote 27 down vote accepted

Short answer

As per RFC 3986, a bare % character is not a valid URI syntax; it should be followed by two meaningful hexadecimal digits.

Long answer

The HTTP status code you got belongs to the 4xx class:

4xx: Client Error - The request contains bad syntax or cannot be fulfilled

Source: Hypertext Transfer Protocol (HTTP) Status Code Registry

In particular, code 400 is defined by the Internet Engineering Task Force (IETF) in RFC 2616:

10.4.1 400 Bad Request

The request could not be understood by the server due to malformed syntax. The client SHOULD NOT repeat the request without modifications.

Source: RFC 2616 - Hypertext Transfer Protocol -- HTTP/1.1

Quoting Wikipedia (bold emphasis mine):

The characters allowed in a URI are either reserved or unreserved (or a percent character as part of a percent-encoding).

Source: Percent-encoding - Percent-encoding in a URI

If you want to insert a literal % symbol, you need to use its percent-encoded representation: %25.

Further reading

share|improve this answer

The percent sign is for inserting a character that is normally not supported in the url. For example %20 is the same as a space.

share|improve this answer
And to insert a percent character itself, it's %25 – Robotnik May 29 '14 at 3:50
A + is a shortcut way to encode a space. If you want a real plus sign, use its hex code, %2B. – Phil Perry May 29 '14 at 13:44
+ is the correct encoding for a space only within a query string. %20 is the correct encoding elsewhere within the url. – Eden Townsend May 29 '14 at 14:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.