October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk1 min

Why encodeURIComponent() Does Not Encode a Single Quote

JavaScript’s encodeURIComponent() leaves a straight apostrophe unchanged. Use an RFC 3986 replacement helper when the receiving system requires %27.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

JavaScript’s built-in encodeURIComponent() leaves a straight apostrophe (') unchanged. For example, encodeURIComponent("it's") returns it's, not it%27s. That is documented behavior, not a bug. If the system receiving the value requires apostrophes to be percent-encoded, add a replacement step.

Why does encodeURIComponent() leave an apostrophe unchanged?

encodeURIComponent() encodes a value as one URI component, rather than encoding an entire URL. Its documented set of characters that it does not escape includes letters, digits, and - _ . ! ~ * ' ( ). The straight ASCII apostrophe, U+0027, is therefore passed through literally. See MDN’s encodeURIComponent() reference.

This behavior is distinct from encoding URI structure: for example, the function does encode characters such as & so they are not mistaken for separators within a component. A literal apostrophe may still be acceptable to the system handling the component; whether it must be escaped depends on that system’s encoding requirements.

How can I encode a single quote as %27?

If the target requires the stricter RFC 3986 convention, apply the additional replacements shown in MDN’s RFC 3986 example. It escapes !, ', (, ), and * after calling the built-in function:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
function encodeRFC3986URIComponent(str) {
  return encodeURIComponent(str).replace(
    /[!'()*]/g,
    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,
  );
}

encodeRFC3986URIComponent("it's"); // "it%27s"

The helper produces uppercase hexadecimal escapes, including %27 for the apostrophe. This is a stricter encoding convention, not a fix for a defect in encodeURIComponent(). Use it when the receiving system calls for those reserved characters to be percent-encoded; otherwise, the built-in function’s component encoding may be sufficient. RFC 3986 identifies these characters as reserved in its reserved-character list.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What if the input contains a typographic apostrophe or a malformed surrogate?

The example concerns the straight ASCII apostrophe, U+0027. A typographic apostrophe such as U+2019 is a different character and is not part of the function’s documented unescaped set, so it is percent-encoded when passed to encodeURIComponent().

The function throws a URIError if the input contains a lone surrogate. MDN documents this exception and suggests String.prototype.toWellFormed() as one way to replace lone surrogates before encoding. See MDN’s lone-surrogate guidance.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.