API & Web

Query String Parser and Builder

Breaks a query string into parameters, or builds an encoded one, with repeated keys called out.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Leave the mode on parse and paste a URL or a query string.
  2. Select Run.
  3. Look for repeated keys in the summary — those are the ones whose behaviour differs between frameworks.
  4. Switch the mode to build, paste key and value lines, and run it again to get a correctly encoded query string back.

What query string parser does

Paste a whole URL, a query string with or without its leading question mark, or a fragment carrying parameters — all three are recognised, and the summary says which it read. Each parameter is shown decoded, with the raw encoded form beside it when the two differ, so a double-encoded value is visible rather than merely confusing.

Two things get flagged. Repeated keys, because they are legal and every framework handles them differently — some keep the first, some the last, some build a list — and quietly picking one is a real source of bugs. And tracking parameters, the utm_ family and the click identifiers, because they are almost always the part you want to strip before sharing a link.

Frequently asked questions

Both are shown, and the repetition is flagged. Repeated keys are perfectly legal and there is no standard for what a server should do with them: PHP keeps the last, Rails builds an array if the key ends in [], Express depends on configuration. If your URL has them, find out which rule applies before relying on either value.

Because that is what form encoding does — application/x-www-form-urlencoded represents a space as a plus, and %20 is the equivalent used elsewhere in a URL. Both decode to a space in a query string. The parse direction handles either.

The utm_ family from campaign tagging, and the click identifiers gclid, fbclid and msclkid. They are safe to remove when you are sharing a link, and removing them is usually polite — they identify the campaign that sent you, and sometimes more than that.