Why did my plus sign turn into a space?

Because in a query string a plus means a space, inherited from HTML form encoding. A literal plus has to be written as %2B. This catches out international phone numbers more than anything else.

Can the same parameter appear twice?

Yes, and it is how multiple checkbox values are submitted. Frameworks disagree on what to do with it — some build an array, some keep the last value, PHP wants square brackets in the name. The tool shows every occurrence so you can see what actually arrived.

Is there a length limit on a query string?

Not in the specification, but in practice yes. Browsers and servers impose their own limits, commonly around 2,000 characters for reliable behaviour and sometimes as low as 4KB at a proxy. Long payloads belong in a request body.

Is it safe to put an API key in a query string?

No. Query strings appear in server logs, proxy logs, browser history and the referrer header sent to other sites. Secrets belong in a header or a body, both of which stay out of all four.

Query String Parser

Break a URL's query into readable key–value pairs.

Everything runs inside your browser. Your files never leave your device.

Input

Result

The result appears here as you type.

Ask about Query String Parser

Questions about what this tool does, which option to pick, or what it can and cannot handle.

The question you type here is sent to an AI provider to be answered — your files and whatever you put in the tool above are not, and the assistant cannot see them. Answers are generated and can be wrong. The tool itself is not guessing: it runs deterministic code on your device.

About the Query String Parser

A URL with a dozen parameters is a wall of ampersands. Reading one to check a single value, or to see whether a tracking parameter is being appended twice, means counting separators by eye.

This takes a full URL or a bare query string and lays out the parameters as a list. Values are percent-decoded, so %20 appears as a space and %3A as a colon, and the parts of the URL around the query are broken out too.

Repeated keys are handled properly rather than collapsed. A query string can legitimately contain the same key more than once — tags=a&tags=b is how HTML forms submit multiple checkbox values — and different server frameworks disagree about what that means. PHP wants tags[] and builds an array; Rails and Express accept the repeated form; some frameworks silently keep only the last. When a parameter that should be single appears twice, that is nearly always the bug you were looking for, so the tool shows both rather than picking one.

Encoding is where the other half of the bugs live. A plus sign in a query string means a space, a legacy of HTML form encoding, so a value containing a genuine plus must be written as %2B or it arrives as a space instead. This matters constantly for phone numbers in international format, and it is why +919876543210 in a link reaches the server as a space followed by digits.

The other rule worth keeping in mind: query strings are logged. They sit in server logs, proxy logs, browser history and the referrer header sent to third parties. Never put a token, a password or personal detail in one — that is what a request body is for.

How to use it

1Paste the full URL, or just the part after the question mark.
2Read the parameters as a list, with values already percent-decoded.
3Look for keys that appear more than once — a parameter you expected to be single arriving twice is usually the problem.
4Check for plus signs in values that should contain a literal plus; they arrive as spaces unless encoded as %2B.

Questions

Why did my plus sign turn into a space?: Because in a query string a plus means a space, inherited from HTML form encoding. A literal plus has to be written as %2B. This catches out international phone numbers more than anything else.
Can the same parameter appear twice?: Yes, and it is how multiple checkbox values are submitted. Frameworks disagree on what to do with it — some build an array, some keep the last value, PHP wants square brackets in the name. The tool shows every occurrence so you can see what actually arrived.
Is there a length limit on a query string?: Not in the specification, but in practice yes. Browsers and servers impose their own limits, commonly around 2,000 characters for reliable behaviour and sometimes as low as 4KB at a proxy. Long payloads belong in a request body.
Is it safe to put an API key in a query string?: No. Query strings appear in server logs, proxy logs, browser history and the referrer header sent to other sites. Secrets belong in a header or a body, both of which stay out of all four.