Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes—some URL parsers accept a single decimal number as an IPv4 host and interpret it as the same 32-bit address written in four-part dotted-decimal form. The number is an alternate way to write the URL’s host, not a networking shortcut or a different destination. Whether it works depends on the URL parser used by the browser or application.
Why one decimal number can represent an IPv4 address
An IPv4 address is a 32-bit unsigned integer. The WHATWG URL Standard defines parsing behavior that can interpret a one-part decimal host as that integer, provided the input meets the parser’s syntax and range rules.
In the URL host-parsing algorithm, a host that ends in a number is processed as a possible IPv4 address rather than automatically treated as an ordinary domain name. A single numeric component can stand for the full 32-bit value. This is a legacy-compatible numeric host form; it does not mean every application that accepts URLs will recognize it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What happens when you enter the address
- The browser parses the URL. Its URL parser examines the host and, if it accepts the numeric form, interprets the decimal value as an IPv4 address.
- The parser checks validity. The numeric host must satisfy the parser’s syntax and range rules; an out-of-range or otherwise invalid value will not be a valid IPv4 host in this form.
- The address is canonicalized. The parser serializes a successfully parsed IPv4 address in the familiar four-part dotted-decimal form. The URL Standard defines canonical IPv4 text as four shortest-possible ASCII decimal numbers from 0 to 255, separated by dots.
This separates accepted input from canonical output: a parser may accept a legacy numeric spelling while displaying or serializing the address in dotted-decimal form. The odd-looking input does not by itself change the destination when both spellings parse to the same numeric address.
#1 Best Overall
Will it work in every browser or app?
Do not assume so. The standard describes URL parsing behavior, and Chromium’s URL display guidance discusses acceptance of 32-bit decimal IPv4 forms and recommends canonical display. That evidence does not establish identical behavior in every browser version, command-line tool, link previewer, or application that consumes URLs. Different URL-processing layers can parse the same text differently.
For predictable sharing and readability, use the dotted-decimal form. If you are investigating a URL, remember that a browser may normalize the host after parsing; the raw text someone copied is not necessarily the form the browser ultimately displays.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is a decimal IPv4 URL safe to click?
The notation alone does not show that a URL is malicious, nor does it make the destination safer. It can make the host less recognizable to a person, so inspect the parsed or canonical destination rather than relying on whether the original host contains dots. Chromium’s guidance explicitly warns developers not to infer that a host is a domain merely because it has no dots.
For software that filters URLs, raw-string checks are particularly fragile. RFC 3986, section 7.4 notes that URI implementations have accepted numeric address forms beyond dotted quad and advises converting literals to numeric form before filtering, rather than relying on a textual prefix or suffix.
Rank #3
- Parse the URL with the standards-compatible parser used by the relevant application.
- Canonicalize and classify the parsed host, then apply policy to the normalized numeric address—not only to the original text.
- Consider redirects and subsequent parsing or network-handling layers, since URL safety depends on how the receiving application processes and uses the URL.
The security issue is not that decimal notation is inherently a bypass. The risk is that a person or software component treats the raw spelling as the complete security signal, or that separate components interpret the URL differently. The RFC 3986 security discussion and the WHATWG URL Standard describe the parsing context behind that distinction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
