Query String Parser and Builder

About Query String Parser and Builder

A query string looks like a map and is not one, and every awkward thing about handling one follows from that. A key can appear more than once, and that is how lists are written — ?tag=a&tag=b is two entries, not one overwritten. Most "get one parameter" helpers return the first and silently discard the rest, which is a bug that only shows up with real data.

Order matters more often than people expect. OAuth 1.0a, AWS SigV4 and every webhook that signs its callback compute over the exact string, so reordering a parameter or re-encoding a character breaks the signature while leaving the request looking identical. Sorting is offered here and never applied on its own.

The decoding has a trap of its own: + means a space in a query string and a literal plus everywhere else in a URL, and decodeURIComponent does not know the difference. Both sides are shown — what each parameter decodes to, and exactly how it was written — so a double-encoded value can be recognised rather than guessed at.

Where it helps

• Keeps repeated keys as separate entries rather than collapsing them, which is what a list in a query actually is.
• Shows the decoded value and the raw text side by side, so a double-encoded parameter is visible instead of mysterious.
• Handles + as a space correctly, which is a query-string rule and not a general URL one.
• Recognises bracket and dot notation and says which convention would be needed to read it as nesting, rather than assuming one.
• Flags a credential in a query string, which is the wrong place for one and a very common mistake.
• Builds as well as parses, keeping order by default because some signatures are computed over it.

Limits

• Nesting conventions are a framework choice, not a standard, so the JSON view is one reading of the query rather than the reading.
• It does not fetch the URL or check that the parameters mean anything to the far end.
• Very long values are shown in full rather than truncated, which can make a table wide.
• The builder takes one pair per line, so a value containing a newline has to be encoded before it goes in.

Frequently asked questions

Why does my parameter appear twice?

Because it was written twice, and that is legal and meaningful — it is how a list is expressed in a query string. What varies is what reads it: some frameworks give you an array, some the first value, some the last. This shows you all of them so you can tell which case you are in.

Should a space be %20 or +?

Both are correct in a query string. + comes from the HTML form encoding and %20 from the URL standard; every server understands both. %20 is the safer choice if the same string might be used anywhere else in a URL, because outside the query a plus is a literal plus.

Is it safe to sort the parameters?

Usually, but not always. A signed URL — OAuth 1.0a, SigV4, a signed webhook callback — has a signature computed over a specific string, and some schemes require sorted order while others sign exactly what was sent. Check which before reordering anything.

Why is a token in a URL a problem?

Because a query string is not private. It is written to the access log of every proxy and server it passes through, kept in the browser's history, and historically sent to third parties in the Referer header. Credentials belong in a header or a request body.

Related tools

• URL Encoder — Percent-encode components or whole URLs
• OAuth 2.0 / OIDC Helper — PKCE verifiers and challenges, state, nonce, and checking what came back
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Phishing URL Checker — Where a link really ends up, how old the domain is, and which tricks it uses
• HTML Formatter — Indent and tidy HTML markup
• CSS Formatter — Format stylesheets with consistent indentation

More Web Development tools

• HTML Formatter — Indent and tidy HTML markup
• CSS Formatter — Format stylesheets with consistent indentation
• JavaScript Formatter — Re-indent JavaScript and TypeScript source
• SCSS/SASS Formatter — Format SCSS syntax and nested rules
• TypeScript Formatter — Format TypeScript source code
• SQL Formatter — Format SQL statements with dialect selection
• SQL Minifier — Collapse formatted SQL into compact text
• CSS Unit Converter — px, rem, em, percentages and viewport units, with a preview
• CSP Generator — Build a Content-Security-Policy, or check one, and write it for your server or framework
• CORS Generator — Write CORS configuration for nginx, Express, Go, Django, ASP.NET, Spring and more, and test an origin against it
• cURL Builder — Build an HTTP request and get it as curl, JavaScript, TypeScript, Go, Python, PHP, C#, Java and more
• Minifier — Shrink CSS, HTML or JavaScript
• Flexbox Playground — Try every flex property and read the CSS back
• CSS Grid Playground — Build a grid template and see the tracks it makes
• Responsive Viewport Tester — Render your markup at phone, tablet and desktop widths
• SVG Path Viewer — Draw path data and read back what it contains
• SVG to CSS Converter — Turn an SVG into a data URI for CSS or an img tag
• OAuth 2.0 / OIDC Helper — PKCE verifiers and challenges, state, nonce, and checking what came back
• Regex Tester — Test patterns, inspect groups and preview replacements
• User-Agent Parser — Identify the browser, engine, operating system and device behind a User-Agent string
• HTTP Status Codes — Look up what a status code means, when to send it, and whether it is cached or safe to retry
• HTML to JSX — Convert HTML and SVG markup into JSX for React, with styles, attributes and whitespace handled
• Semver Checker — Test versions against npm ranges, sort them by precedence, and see what each bump produces
• Cookie Parser and Builder — Read Set-Cookie and Cookie headers, check them against browser rules, and write one for your framework