Recommended Free Tools
Yes—when the browser’s URL parser accepts the legacy numeric IPv4 form, a single decimal number can represent the same 32-bit address as a familiar dotted IPv4 address. It is an alternate way to write the URL host, not a networking bypass. The parser interprets the number and normally serializes the address in canonical dotted-decimal form.
How can one decimal number represent an IPv4 address?
An IPv4 address is a 32-bit unsigned integer. The WHATWG URL Standard defines URL parsing behavior that can interpret a one-part decimal host as that full value, provided the input meets the algorithm’s syntax and range rules. For example, the integer 2,130,706,433 is equivalent to 127.0.0.1: the four dotted components encode the same 32-bit value.
![Computer Networking Bible: [3 in 1] The Complete Crash Course to Effectively Design, Implement and Manage Networks. Including Sections on Security, Performance and Scalability](https://m.media-amazon.com/images/I/41H4YJnxKgL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
When a parser treats a host as an IPv4 address, it serializes it in canonical dotted-decimal form. The standard’s canonical IPv4 spelling consists of four shortest-possible ASCII decimal numbers from 0 through 255, separated by dots. That output convention is distinct from the parser’s compatibility behavior: a noncanonical numeric spelling may be accepted as input even though the canonical serialized address has dots.
The URL Standard also describes other legacy numeric forms, including abbreviated multi-part forms with constraints on the components. This article focuses on a single decimal integer. Applications that use different URL parsers may handle alternate spellings differently, so do not assume every browser surface or URL-consuming program accepts them.
#1 Best Overall
What happens when you enter the decimal form?
- Enter a URL with the number as its host. For example, the URL
http://2130706433/uses a one-part decimal host. This example is for illustrating URL parsing; whether a local service responds depends on the machine and network. - The URL parser classifies the numeric host. Under the WHATWG URL Standard’s host-parsing algorithm, a host that ends in a number is handled as a possible IPv4 address, subject to syntax and range checks.
- The parsed value is serialized canonically. When accepted as IPv4, the one-part value is represented as dotted decimal; in this example, the canonical host is
127.0.0.1. - The browser makes a request to that address. The spelling does not create a separate destination or change the usual networking behavior. Whether the request succeeds depends on the protocol, service, and network conditions.
Is a decimal IPv4 URL a different or hidden destination?
No. If the parser maps the number and the dotted form to the same 32-bit address, they identify the same IP address. The unusual spelling can make the destination less obvious to a person reading or checking a URL, but it does not itself bypass routing, authentication, or access controls.
Chromium’s Guidelines for URL Display recommend canonicalizing IPv4 literals for display and caution against treating the absence of dots as proof that a hostname is a domain. Browser display behavior and parsing support are separate concerns: the URL parser may accept a legacy spelling while the browser presents a canonical address.
Is it safe to click or process a decimal IPv4 URL?
The notation alone does not make a URL malicious or safe. The relevant question is what address the receiving software parses and what it does with the URL. A person may fail to recognize a numeric host, and a software filter that checks only the raw text can overlook an address represented in an unexpected form.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →RFC 3986, section 7.4, discusses alternate numeric host forms and warns that string-based filtering can be undermined by them. Its guidance is to convert literals to numeric form and apply filtering to the numeric value, rather than relying on a textual prefix or suffix. The risk is inconsistent interpretation or weak validation—not a special property of decimal notation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should developers validate URLs containing IP addresses?
- Parse with the relevant URL parser. Do not assume the raw host text has one spelling or that a host with no dots must be a domain.
- Canonicalize and classify the parsed host. Apply policy to the normalized address value, not a string pattern that only recognizes dotted quad.
- Account for the entire request path. If redirects or another component re-parses the URL, ensure those later steps cannot change the effective destination or evade the policy.
- Use controls appropriate to the application. URL safety depends on the context in which an untrusted URL is parsed and used; a valid parse alone does not establish that a request is permitted.
These principles follow the URL Standard’s parsing model, Chromium’s display guidance, and RFC 3986’s security discussion. They do not establish identical behavior for every browser or every application; validation must reflect the parser and request flow actually in use.
Quick Recap
Best Value
Rank #4
How do the common representations differ?
| Representation or handling | What it means | What to keep in mind |
|---|---|---|
Dotted quad, such as 127.0.0.1 |
Canonical IPv4 text: four decimal components from 0 to 255. | This is the standard’s canonical output form. |
One decimal integer, such as 2130706433 |
A compatibility input form that a WHATWG-compatible URL parser can interpret as the full 32-bit address when it passes the algorithm’s checks. | Acceptance depends on the parser; canonical serialization converts an accepted IPv4 value to dotted decimal. |
| Raw-string security filtering | A policy based on textual patterns such as dots, prefixes, or suffixes. | Can miss alternate spellings; RFC 3986 recommends filtering numeric address values instead. |
| Parsed and normalized address filtering | A policy applied after parsing and classifying the host. | Must also account for redirects and subsequent parsing or request-handling layers. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
