%5D is a close bracket
%5D is a close square bracket. Outside an IPv6 host, it usually closes a bracketed parameter name like filter[status].
| Character | "]" |
|---|---|
| Name | Close Square Bracket |
| Encoded | %5D |
| Reserved | Yes — it has a special meaning in a URL |
Why it breaks things
A close bracket shares its one job with the open bracket: closing the IPv6 address in a URL's host, as in http://[::1]:8080/. Nowhere else does the spec give it a meaning, though most real parsers tolerate it as ordinary data in a path or query string.
Its everyday appearance differs from the open bracket's, though. Frameworks that read nested or repeated parameters — Rails, PHP, libraries like qs — use a matched pair of brackets in the query key, not the value: filter[status]=open, or items[]=a for a list. The URL layer hands the key filter[status] to whatever is listening, unchanged.
Because the meaning lives in the closing bracket, a key missing it is not read as broken — it is read as one long literal key. Drop the ] from filter[status]=open and a parser expecting nested parameters sees the flat key filter[status, with no status field anywhere in the result.
Real examples
Without encoding
https://example.com/search?filter[status=open&filter[category]=shoes
With encoding
https://example.com/search?filter[status]=open&filter[category]=shoes
The missing ] after status means the whole string filter[status is read as one flat key. A framework expecting a nested filter object with a status field finds nothing named status at all — the value is there, just filed under the wrong key, with no error raised.
Without encoding
https://example.com/api/search?user[address][city=Auckland
With encoding
https://example.com/api/search?user[address][city]=Auckland
The deeper the nesting, the easier a closing bracket is to lose during a quick edit. Here the missing ] after city merges the tail of the key into one string, user[address][city, so code reading params.user.address.city finds nothing there, even though a value was sent.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Why did my nested parameter not show up on the server, even though I definitely sent it?
- A common cause is a missing closing bracket in the key. filter[status without its ] is read as one flat key, not a nested status field, so the value ends up somewhere the server-side code never looks.
- Do items[] and items[0] mean the same thing?
- Both are conventions used by frameworks for list-style parameters, not by the URL standard itself. items[] typically appends to a list; items[0] sets a specific position. Which one a given API expects depends entirely on that API, not on anything the URL specifies.
- Is bracket syntax like filter[status] part of the URL standard?
- No. The URL standard sees an opaque key and value, nothing more. The nested-parameter meaning is a convention added by specific web frameworks, such as Rails and PHP, not something a browser or RFC 3986 defines.
- Do I need to encode a close bracket if my parameter names have no brackets in them?
- Only if a literal ] appears as data inside a value, unrelated to any key-naming convention — for example a value using mathematical interval notation. Most servers tolerate it raw, but encoding removes any doubt.