URL Encode Colon: Handling : , and - in URLs

Colon — reserved, context dependent

: separates the scheme from the rest of the URL and the host from the port. Inside a value it must be %3A, or a strict parser may misread the URL.

In practice, a colon inside a query value is widely accepted — ?filter=status:active works nearly everywhere. Inside a path segment it is riskier, and in the first segment of a relative URL it is genuinely dangerous: foo:bar can be parsed as a scheme. Encode it there.

Timestamps are the everyday case: 2026-08-29T14:30:00Z in a query string becomes 2026-08-29T14%3A30%3A00Z when encoded properly.

Comma — reserved, rarely enforced

, is in the reserved set as a sub-delimiter, so %2C is the correct escape. Most frameworks accept a literal comma in query values without complaint.

The catch is that some APIs treat a comma as a list separator: ?ids=1,2,3 means three values. If a comma inside your data would be read that way, encoding it as %2C is what distinguishes one value containing a comma from several values.

Hyphen — never encode it

- is unreserved, alongside _, . and ~. It is safe everywhere in a URL and should be left as-is.

Encoding it as %2D is technically legal but produces a non-canonical URL, which can break cache keys, signature checks and analytics grouping. Some encoders do it anyway — if yours does, that is a reason to switch functions.