They are _encoded_ as ASCII. But they very explicitly support arbitrary octets. The interpretation of those octets, and the timing of decode is where the fun s

They are _encoded_ as ASCII. But they very explicitly support arbitrary octets. The interpretation of those octets, and the timing of decode is where the fun starts. Quick quiz: How many hierarchy elements are present? http://example.com/one%2Ftwo/three http://example.com/one%2Ftwo/three If your Apache config has a proxy for `/one`, does that url match? What is the value of the utf8 param? http://example.com/frosty?utf8=%26%C7 http://example.com/frosty?utf8=%26%C7 application/x-www-form-urlencoded historically didn't specify encoding either. So POST doesn't save you. It is bad, and just gets worse. HTML/HTTP are just a bit too old to benefit from the genius of Ken Thompson. They started absolutely ignorant of character encoding. Berners-Lee was a physicist who just wanted to share some cat memes. https://tools.ietf.org/html/rfc1738#section-2.2 https://tools.ietf.org/html/rfc1738#section-2.2 https://blogs.warwick.ac.uk/kieranshaw/entry/utf-8_internationalisation_with https://blogs.warwick.ac.uk/kieranshaw/entry/utf-8_internati...