%7B is a curly brace
%7B is an open curly brace, most often a leftover template placeholder like /users/{id}.
| Character | "{" |
|---|---|
| Name | Open Curly Brace |
| Encoded | %7B |
| Reserved | No |
Why it breaks things
A curly brace has no defined role in the URL specification. It sits outside both the reserved and unreserved sets, alongside the backslash and the brackets — characters an older URI spec named outright because gateways were known to mangle them.
Browsers treat it more strictly than most of that group, though. Navigate to a URL with a raw { or } in the path and the browser percent-encodes it to %7B or %7D before sending — verified: /users/{id}/orders becomes /users/%7Bid%7D/orders automatically. The request still reaches the server, mistake intact, already escaped.
The mistake it almost always carries is an API template with its placeholder never filled in. A route like /users/{id}/orders should have {id} replaced with a real id first. Ship it as-is, a common slip in copy-pasted documentation, and the request asks for a user literally named "{id}" instead of raising a clear error.
Real examples
Without encoding
https://example.com/users/{id}/orders
With encoding
https://example.com/users/482/orders
{id} was meant to be replaced by a real id before the request was sent. Left in place, the server looks up a user literally named {id}, not user 482, and returns a 404 or an empty result with nothing pointing at the actual bug.
Without encoding
https://{env}.example.com/api/health
With encoding
https://staging.example.com/api/health
This one is worse, because the browser does not encode a brace sitting in the host the way it does in the path. The URL parses without complaint and {env}.example.com is treated as a real hostname, so the failure shows up later as a DNS lookup error, with nothing to say a template variable was left unfilled.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Why does my URL have %7B and %7D in it when I never typed a percent sign?
- The browser encoded a raw { or } automatically before sending the request. Go back and check whatever generated the URL for an unfilled template placeholder.
- Is a curly brace ever required in a URL?
- No. It has no defined use in URL syntax at all. Wherever one appears it should either be percent-encoded, or, more often, it should not be there in the first place.
- Why did my API request return a 404 for a resource that definitely exists?
- Check whether the id in the URL is literally the word inside braces, such as {id}. That means a template placeholder was shipped unfilled, and the server is looking for a resource with that literal name.
- Is %7B the same kind of character as %5B?
- No. An open square bracket is reserved specifically for an IPv6 address in the host. A curly brace has no defined role anywhere in the URL — it is almost always a templating leftover rather than deliberate data.