Google says [ and %5B are different URLs. Which URL variants split your pages?

KEY TAKEAWAYS

1. Encoding a reserved character such as a bracket makes a new URL. Changing hex case does not.
2. Google merges duplicate forms without a penalty, but it may keep the one you did not pick.
3. Crawl cost matters on sites with tens of thousands of fast-changing URLs, not on small ones.
4. Use one form in links, canonicals, sitemaps, structured data, redirects and robots.txt.

On 20 October 2026, Google's John Mueller said something he had not expected to say. A URL with raw square brackets, such as ?filter[]=123, and the same URL with the brackets percent-encoded, ?filter%5B%5D=123, are two different URLs to Google. Vanessa Fox had asked the question on Bluesky, and Search Engine Roundtable reported the exchange. The answer matters beyond brackets. It shows which small differences in a URL create a second address for the same page, and which do not.

What did Google actually confirm?

Mueller pointed to RFC 3986, the standard that defines URL syntax. Square brackets are reserved characters, and the standard says two URLs that differ only in whether a reserved character is encoded are not equivalent. He added a quick check: compare the two forms with JavaScript's URL parser and the result is false.

He also set out what happens next. If your server returns the same page for both forms, Google may crawl both, notice the match and keep one. His advice was to "pick one, and use it consistently," in links, canonical tags, sitemaps and structured data.

Two details are easy to miss. He said the hex case of an encoding does not matter, so %5B and %5b are the same. And he said raw brackets in a query string are technically invalid, since the standard allows brackets only around IPv6 addresses in a hostname.

The Roundtable headline says Google has internal issues with brackets. The article body is narrower. Mueller said Google saw issues with these characters more than ten years ago, and later added that there are no issues, only very specific standards. The live risk is consistency, not a known Google bug.

The timing fits a wider push. On 14 October Google opened a video series on technical edge cases, The Non-Canonical Cabinet, with an episode on what a URL may contain. Gary Illyes said Googlebot crawls and processes emoji in paths once browsers percent-encode them, and that keywords in a URL carry very little weight once Google can see the page's content.

Why are some encoded URLs the same and others different?

RFC 3986 sorts characters into two groups. Unreserved characters are letters, digits, hyphen, full stop, underscore and tilde. Encoding one of those, such as %7E for ~, does not change the URL. Reserved characters include : / ? # [ ] @ ! $ & ' ( ) * + , ; =. Encoding one of those does change the URL, because the raw form may carry structural meaning.

The standard also lists normalisations a tool may apply before comparing URLs: uppercase hex digits, decode unreserved characters, lowercase the scheme and host, remove the default port. Many tools do not apply them. We tested this ourselves in Node 22, whose URL parser follows the WHATWG URL Standard. It kept filter[] raw and %5B%5D encoded, so the two stayed distinct. It also left %7Efoo unchanged rather than decoding it to ~foo, and treated %5b and %5B as different strings. We did not test browser address bars or Googlebot.

This qualifies one part of Mueller's answer. He said browsers usually encode brackets. A 2023 proposal to the WHATWG notes that its standard already tolerates raw brackets in query strings, and our test left them raw. Whether a bracket reaches your server encoded depends on the software in between. The W3C validator flags raw brackets in a query as illegal, and Rocket Validator warns that some clients and proxies may reject or alter them.

So the standard, Google and your own software can each draw the line in a different place. That is why one form everywhere is safer than relying on any of them to normalise.

Which URL variants does Google treat as separate?

Case cuts across the whole URL except the host. Mueller said in 2025 that path, file name and query parameters are case-sensitive, and that robots.txt rules are too.

Does a split URL hurt rankings?

Two camps read the same facts differently.

The first says it is harmless. In April 2026 Mueller said there is no penalty or ranking demotion for several URLs pointing at one page, and that almost every site has such variants. Gary Illyes described in 2020 how Google reduces each page to a checksum after stripping boilerplate, clusters matches and picks one canonical, and he said canonicalisation is separate from ranking. The site Fox was reviewing uses the invalid bracket form throughout and indexes fine.

The second says fix it anyway. Mueller's line in that same April thread was that you make it harder on yourself, because Google keeps one form and you may prefer the other. In 2021 he said crawling duplicate variants can slow Google's discovery of other content. Google's crawl budget guide says duplicates waste crawl time and should be consolidated. Its faceted navigation guide says brackets, commas and semicolons are hard for crawlers to recognise as parameter separators. Mueller also warned this week that other crawlers may be less precise than Google. Bing argued back in 2012 that canonical tags do not fully solve duplicates, because engines keep fetching the duplicate URLs to check them.

The evidence supports both, at different scales. There is no sign of a ranking penalty. There are three real costs: losing control of which URL is indexed, crawl spent on a second copy, and other systems such as crawlers, analytics or robots.txt treating the forms differently. The crawl cost is material only on large or fast-changing sites. Google's guide puts that at roughly 1 million pages changing weekly, or 10,000 pages changing daily. Below that, the first and third costs are what you are fixing.

Where does the second form come from?

The second form rarely comes from one bad template. It comes from systems that each make a reasonable choice:

• Navigation and filter templates write raw brackets, which many frameworks use for array parameters.
• The sitemap generator encodes every reserved character.
• The canonical tag echoes the requested URL, so each form declares itself canonical.
• Structured data and hreflang are built by a separate plugin with its own encoding.
• Robots.txt rules are written by hand in one form. RFC 9309, the robots.txt standard, decodes encoded ASCII characters before matching but keeps reserved ones encoded, so a rule written with [ may not catch %5B.

Each piece is defensible. Together they send Google conflicting hints, and Google's canonical guide warns against declaring different canonicals through different methods.

How do you audit for one form everywhere?

1. List the variant types your URLs can contain. Check for brackets, spaces, non-ASCII text, capitals, trailing slashes and parameter order. One crawl export is enough to see which apply.
2. Choose the preferred form for each. For reserved characters used as data, Google's URL guide says they must be percent-encoded, so %5B is the documented choice. For case, use lowercase. For slashes, pick whichever form most links already use.
3. Compare five places for each sample URL. Internal links, the canonical tag, the sitemap, structured data and hreflang should hold the same string. Google's sitemap guide says to list only the preferred URL.
4. Redirect the other form. A 301 to the preferred form is the strongest signal in Google's canonical guide. If the framework cannot redirect an encoding variant, make the canonical tag output the preferred form rather than echoing the request.
5. Check robots.txt rules against both forms. If a disallow rule targets a filter parameter, test it against the raw and encoded versions.
6. Inspect a sample in Search Console. URL Inspection shows the user-declared and Google-selected canonical. Enter the exact URL, since Google treats a differently encoded URL as a different URL.
7. Allow time. Google's troubleshooting guide says clustered pages can stay together for up to two weeks after a fix. Review a fortnight later, not the next day.

Making sure the right pages are crawled at all is a separate question. We covered the routes into Google's index, from sitemaps to URL Inspection, in which intake route to use for fresh pages.

What does this look like on a large store?

A hypothetical example. An online shop has 40,000 filtered listing pages it wants indexed, with stock and prices changing daily. That puts it above the 10,000-page daily-change line in Google's crawl budget guide.

Its filter links use ?size[]=10. Its sitemap plugin writes ?size%5B%5D=10. Its canonical tag echoes whichever form was requested. Every listing page is reachable at two addresses, so Googlebot can find up to 80,000 URLs for 40,000 pages. Each form declares itself canonical, and the sitemap backs the encoded one. Google will still pick one per cluster, but nothing tells it which.

The fix uses steps 2 to 4. The shop chooses the encoded form, changes the filter template to output it, sets the canonical tag to the encoded string and 301-redirects raw requests. The sitemap already matches. A small brochure site with one consistent raw form would need none of this.

When should you leave it alone?

Leave it when one form is used everywhere and URL Inspection shows Google choosing the canonical you declared. Mueller expects such sites to keep working, and a rebuild for its own sake adds redirect risk for no gain.

Fix it when sources disagree, when Google picks a canonical you did not declare, or when the site is large enough for crawl to matter. Also fix it if non-Google crawlers matter to you, since they may normalise less carefully. Our guide on which AI crawlers to allow or block covers how those bots reach your pages. If you want to see how your pages and brand show up across search and AI answers, join the waitlist.

Questions

Does Google treat percent-encoded URLs as the same as unencoded ones?

It depends on the character. For reserved characters such as square brackets, John Mueller confirmed on 20 October 2026 that Google treats the two forms as different URLs. Hex case is different: Mueller said %5B and %5b are equivalent. We found no Google statement on encoded letters, digits, hyphens or tildes.

Will duplicate URL variants hurt my rankings?

Google has said there is no penalty or ranking demotion for several URLs serving the same content. It clusters them and picks one canonical. The costs are control, because Google may pick a form you did not want, and crawl time, which matters most on large sites with fast-changing pages.

Should I change URLs that already use raw square brackets?

Not urgently, if one form is used consistently and the pages index as you expect. Mueller expects such sites to keep working but would not build a new site that way. Fix it when links, canonicals and sitemaps disagree, or when Search Console shows Google choosing a canonical you did not declare.

Are URLs case sensitive for SEO?

Yes for the path, file name and query string, and no for the hostname. Google's documentation says it treats /APPLE and /apple as distinct URLs. Pick lowercase, redirect other forms, and remember that robots.txt rules are matched case-sensitively too.

Sources

1. Search Engine Roundtable, Google Had Internal Issues With Square Brackets [] Punctuation Marks In URLs seroundtable.com
2. Google Search Central, URL structure best practices for Google developers.google.com
3. Google Search Central, How to specify a canonical URL with rel="canonical" and other methods developers.google.com
4. Google Search Central, Fix canonicalization issues developers.google.com
5. Google Search Central, Managing crawling of faceted navigation URLs developers.google.cn
6. Google Search Central, Large site owner's guide to managing your crawl budget developers.google.cn
7. Google Search Central, Build and submit a sitemap developers.google.com
8. Search Console Help, URL Inspection tool support.google.com
9. IETF, RFC 3986 Uniform Resource Identifier (URI) Generic Syntax datatracker.ietf.org
10. IETF, RFC 9309 Robots Exclusion Protocol datatracker.ietf.org
11. Search Engine Journal, Google launches a video series for odd technical SEO questions searchenginejournal.com
12. PPC Land, Google says URL keywords become irrelevant once a page has content ppc.land
13. Search Engine Roundtable, Google Can Handle Multiple URLs To A Page But Why Make It Harder seroundtable.com
14. Search Engine Journal, Google says it can handle multiple URLs to the same content searchenginejournal.com
15. Search Engine Journal, Google's advice on canonicals. They're case sensitive searchenginejournal.com
16. Search Engine Journal, Google: URLs are case sensitive searchenginejournal.com
17. Search Engine Journal, Google podcast on how canonical pages are chosen searchenginejournal.com
18. Search Engine Roundtable, Google: You should probably remove spaces from your URLs seroundtable.com
19. Bing Webmaster Blog, Better than canonical. URL normalization blogs.bing.com
20. WHATWG URL issue 753 via public-webapps-github, Allow [ and ] as URL code-points lists.w3.org
21. Wikipedia, URI normalization en.wikipedia.org
22. Wikipedia, Percent-encoding en.wikipedia.org
23. Rocket Validator, Illegal character in query. Square bracket is not allowed rocketvalidator.com

NEXT STEP

See where your brand stands.

Your Digital Authority Score, who AI recommends for your target questions, and the placements that close each gap. Your first report is free.

Get your free report →