%60 is a backtick
%60 is a backtick, excluded from RFC 3986's allowed characters and encoded automatically by browsers only in a URL's path.
| Character | "`" |
|---|---|
| Name | Backtick |
| Encoded | %60 |
| Reserved | No |
Why it breaks things
A backtick is not a sub-delimiter and not part of the unreserved set — RFC 3986 excludes it outright, in the same small group as the caret and the curly braces. Nothing about the generic URL syntax gives it a job, and a strictly valid URL should never contain one raw.
Browsers apply that rule unevenly. Verified: a raw ` in a URL's path is percent-encoded automatically before the request is sent, so /docs/`intro`/page becomes /docs/%60intro%60/page on its own. In a query string, past the first ?, that encoding does not happen — a raw ` there passes through exactly as typed, all the way to the server.
Its everyday source is Markdown. A code span written between backticks, like see `/api/v2` for details, can end up copied whole into a link if whatever generated the page did not strip the markup first. And in a query value that survives unencoded, the risk moves to whatever handles the URL next: pasted into an unquoted or double-quoted bash command, a backtick starts command substitution, and bash tries to run whatever sits between the pair before the rest of the line executes.
Real examples
Without encoding
https://example.com/docs/`intro`/setup
With encoding
https://example.com/docs/%60intro%60/setup
A backtick in the path does not survive raw — browsers percent-encode it to %60 automatically before the request goes out, verified directly. The page still loads, just at an address with %60 in it instead of the literal backtick that was probably meant to be Markdown, not a URL.
Without encoding
https://example.com/search?q=`whoami`
With encoding
https://example.com/search?q=%60whoami%60
Unlike the path, a backtick in a query value is not auto-encoded by the browser and reaches a shell exactly as typed. Pasted unquoted, or even inside double quotes, into a bash command, the text between the backticks runs as a command, and its output — here, the current username — is substituted into the line before the request is made.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Is a backtick ever valid raw in a URL?
- No. RFC 3986 excludes it from both the reserved and unreserved sets, so a strictly valid URL should always percent-encode it. Browsers only enforce this automatically in the path, not in the query string or fragment in the same way.
- Why did my link have %60 in it when I never typed a percent sign?
- If the backtick was in the path, the browser encoded it automatically before sending the request. Check whatever generated the link for leftover Markdown syntax — a code span's backticks are a common source.
- Does putting a URL in double quotes protect it from backtick substitution in bash?
- No. Double quotes stop many special characters, but not backticks — command substitution still runs inside them. Single quotes are the only reliable way to keep a backtick in a URL literal on the command line.
- Is %60 the same kind of character as %5E?
- Yes, the same family — both are excluded outright by RFC 3986, alongside the curly braces. They differ in browser handling: a raw backtick in a path gets auto-encoded, while a raw caret in the same spot is typically left alone.