%3E is a greater-than sign
%3E is a greater-than sign, also called an angle bracket, and it most often shows up pasted along by accident, not typed on purpose.
| Character | ">" |
|---|---|
| Name | Greater Than |
| Encoded | %3E |
| Reserved | No |
Why it breaks things
A greater-than sign has no valid place in a URL. RFC 3986 excludes it outright, the same category as < and the double quote — never a legal literal character, encoded or not. A browser percent-encodes a raw > to %3E before a request is sent, the same way it handles <.
The everyday source is far less dramatic than an attack. Technical writing and emails commonly wrap a bare URL in angle brackets, like <https://example.com/setup-guide>, to mark exactly where the address starts and ends in plain text. Copy that "link" starting from the < and it is easy to include the trailing > with it.
The result is a URL ending in setup-guide> instead of setup-guide. That extra character makes the address point at a path that does not exist, so the request fails or lands on a 404 — not because > is dangerous, but because a character never part of the address came along for the ride.
Real examples
Without encoding
https://example.com/docs/setup-guide>
With encoding
https://example.com/docs/setup-guide%3E
The > here is a stray character picked up from a link that was wrapped in angle brackets in an email or a document. Encoding it to %3E does not fix the underlying problem — the character was never part of the real address, so the request still fails to reach the intended page.
Without encoding
https://example.com/search?filter=price>100
With encoding
https://example.com/search?filter=price%3E100
An ordinary comparison operator, not a stray bracket. A browser encodes the raw > to %3E automatically before sending the request; a script building this URL by hand should do the same before it leaves your code.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Why does my link end in %3E or a stray > and not work?
- The URL was likely copied out of a document or email that wrapped it in angle brackets to mark its boundaries, like <https://example.com/page>. If the copy included the closing bracket, that extra character is now part of the address and points nowhere real.
- Do I need to percent-encode a literal > in a URL?
- Yes, if you are building the URL yourself rather than typing it into a browser. RFC 3986 excludes a raw greater-than sign, and browsers encode it automatically, but hand-built requests should encode it explicitly.
- Is %3E related to %3C?
- Yes, the opening and closing half of the same bracket pair. Both are excluded from URLs by RFC 3986, though they tend to arrive by different routes — < more often from an injected script tag, > more often from a pasted link.
- Why do documents wrap URLs in angle brackets in the first place?
- It marks exactly where the address starts and stops in a sentence, so trailing punctuation like a period or comma is not mistaken for part of the URL. The convention only causes trouble when the brackets get copied along with the link.