URL Encode Password: Credentials in Connection Strings

Which characters break it

@ separates credentials from host, so a password containing it makes the parser see the wrong hostname. : separates user from password, / starts the path, # starts a fragment and silently truncates everything after it.

A password like p@ss:w0rd/! must be written p%40ss%3Aw0rd%2F%21. The # case is the nastiest — it does not error, it just quietly drops the rest of the string, giving an authentication failure with no clue why.

Encoding it correctly

Percent-encode the password component only, never the whole connection string:

# Python
from urllib.parse import quote
dsn = f"postgres://user:{quote(password, safe='')}@host:5432/db"

// Node
const dsn = `postgres://user:${encodeURIComponent(password)}@host:5432/db`;

safe="" matters in Python — the default leaves / unencoded, which is exactly one of the characters that breaks the URL.

Better: keep it out of the URL

A password inside a connection string ends up in process listings, shell history, crash dumps, error messages and logs. Encoding does nothing about any of that.

Most drivers accept credentials as separate parameters rather than a URL — use that form when available. Otherwise keep the DSN in an environment variable or a secret manager, never in source control, and make sure your error handler redacts it before logging.

If a password must go through a URL, prefer generating one from an alphanumeric alphabet. It sidesteps the encoding question entirely, and length matters far more than symbol variety for strength.