%5B is an open bracket
%5B is an open square bracket, mainly seen wrapping an IPv6 address in a URL's host, like http://[::1]:8080/.
| Character | "[" |
|---|---|
| Name | Open Square Bracket |
| Encoded | %5B |
| Reserved | Yes — it has a special meaning in a URL |
Why it breaks things
An open bracket has exactly one defined job: marking the start of an IPv6 address in the host, right after the //. Outside that spot it is a gen-delim with no meaning of its own, and strictly speaking should be percent-encoded as ordinary data.
The bracket exists because an IPv6 address already contains colons, like 2001:db8::1, and a colon after a host normally starts a port. Brackets tell the parser everything inside belongs to the host. Verified directly: 2001:db8::1:8080 with no brackets fails to parse; [2001:db8::1]:8080 works.
Outside the host, most real parsers are lenient about a literal bracket — it shows up constantly in query strings, especially the PHP and Rails-style array parameter, items[]=a. The one place a bracket is never treated loosely is the host: wrap anything that is not a real IPv6 address in one and the browser refuses to parse the URL at all.
Real examples
Without encoding
http://2001:db8::1:8080/status
With encoding
http://[2001:db8::1]:8080/status
Without brackets, the first colon after // is read as the start of a port, and 2001 is not a valid one — the address is invalid, and most URL parsers, including the one browsers use, reject it outright instead of guessing at the intended host.
Without encoding
http://[api-server]:8080/health
With encoding
http://api-server:8080/health
Brackets in the host are reserved specifically for an IPv6 address. Wrapping an ordinary hostname in them, maybe copied from template syntax used elsewhere in the same codebase, produces an invalid URL — the browser rejects it rather than treating the brackets as decoration.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Why does an IPv6 address need square brackets in a URL but an IPv4 address does not?
- Because an IPv6 address already contains colons, which would otherwise be confused with the colon that introduces a port number. IPv4 addresses have no colons, so there is nothing to disambiguate.
- Can I use square brackets anywhere else in a URL?
- Strictly, they are supposed to be percent-encoded outside the host. In practice most servers tolerate a raw bracket in a query string, which is why PHP and Rails-style array parameters like items[]=a work without encoding.
- Why did a URL with [::1] fail in one tool but work in my browser?
- Some libraries are less lenient about the IP-literal host format than mainstream browsers. If a tool rejects a bracketed IPv6 address, check whether it supports that host format at all before assuming the address itself is wrong.
- Do open and close brackets always come in pairs?
- Yes. Wherever a bracket has real meaning — wrapping an IPv6 host, or marking a framework's nested parameter key — it needs both the open and the close. See %5D for what happens to a query key when the closing bracket goes missing.