Google Confirms Square Brackets in URLs Are Not Equivalent to Encoded Forms

Google's John Mueller confirmed this week that a URL containing raw square brackets is not equivalent to its percent-encoded version. The two forms — ?filter[]=123 and ?filter%5B%5D=123 — are treated as distinct URLs by Google Search, because RFC 3986, Section 2.2 defines brackets as reserved characters.

Mueller, Search Advocate at Google, made the statement on Bluesky in a thread with Vanessa Fox, former Googler and founder of Bing Webmaster Tools-era consultancy Nine By Blue. He wrote: "Well, TIL. I would have assumed they're equivalent, but they're NOT."

The exchange began when Fox asked whether Google treats encoded URL characters as distinct addresses. Her example: example.com/category?filter[]=123 versus example.com/category?filter%5B%5D=123, used across links and canonical values.

Why brackets break URL equivalence?

Mueller anchored the answer in the spec itself. Under IETF STD 66 / RFC 3986, Section 2.2, brackets and plus signs belong to the reserved character set. The RFC states: "URIs that differ in the replacement of a reserved character with its corresponding percent-encoded octet are not equivalent."

He offered a verifiable test in JavaScript:

new URL('https://example.com/category?filter[]=123').href === new URL('https://example.com/category?filter%5B%5D=123').href — returns false.

The reserved set is protected from normalization, so Google cannot silently fold the two variants together at the URL-parsing level. He also corrected his own past guidance, admitting he "probably gave people the wrong answer on this in the past. Woops."

How does Google actually handle the duplicates?

Google's confirmed behavior, per Mueller, works in three steps:

• Google crawls both URL versions if it finds both.
• If both serve the same content — "maybe even checksum level" — Google de-duplicates them and picks one.
• Site owners should pick one form and use it consistently across links, canonical tags, sitemaps, and structured data.

The same logic applies to spaces and plus signs, he added, with one complication. The interpretation of a space, +, or %20 depends on where it sits in the URL — in the path or in the query string. Hex-encoding case does not matter, so %5B equals %5b.

Are raw bracket URLs technically invalid?

Yes, according to the RFC. Mueller flagged an additional problem: brackets may only legally appear in a hostname to wrap raw IPv6 addresses. That makes ?filter[]=123 technically invalid under RFC 3986. Browsers generally hex-encode brackets on entry; servers, in his words, "are like cats."

Fox followed up with a practical concern. One site uses the invalid bracket form throughout, it indexes fine, and migrating would be "a ton of work." She asked whether the site could leave it.

Mueller's reply separated confirmed behavior from risk assessment. "I'd expect it to continue to work - the web is messy and not all of it is 'technically correct'," he said. But he would not build a new site that way. For existing bracket-based sites, he advised extra attention to internal linking, rel=canonical, structured data, and sitemaps to keep everything consistent.

What did Google see internally?

Mueller disclosed that Google hit internal issues with these characters in URLs more than a decade ago. "Seeing some of the issues internally that came up with these kinds of characters in the URL (though they're 10+ years ago)," he wrote.

He then raised a caveat about non-Google systems — this is speculation, not a confirmed statement about other engines. Other crawlers, indexers, and fetchers "aren't as exact in this logic," he said, so site owners should double-check the tools they care about.

What should site owners monitor?

Two practical checks follow from the thread. First, run the JavaScript comparison on your own parameterized URLs to confirm whether variants collapse. Second, audit canonical tags, sitemaps, and internal links for mixed bracket usage — the consistency of those signals, not the bracket choice itself, determines how cleanly Google de-duplicates the URLs. Mueller expects existing bracket-based sites to keep working, but any new parameter-driven site architecture should avoid raw brackets entirely.