How are arrays encoded?

Three common conventions: repeated keys (tag=a&tag=b), bracketed (tag[]=a&tag[]=b), or comma-joined (tag=a,b). Different frameworks expect different shapes — toggle which to use. Rails defaults to brackets, PHP accepts both, Node.js qs defaults to brackets.

Why is a space sometimes + and sometimes %20?

+ is the form-urlencoded convention (used in query strings). %20 is the canonical URL-encoding (used in path segments and modern URLs). Both work; %20 is safer when ambiguous.

Does it preserve key order?

Yes — the output keys appear in the order you add them. URL spec says order is significant in some APIs and not others — preserving it is the safe default.

key=value · url-encoded · repeat · live

Build a query string with proper encoding

Assemble ?key=value pairs with full URL encoding. Repeat keys are preserved. Encoding runs locally — nothing leaves your browser.

Query String Builder

Pairs

keys

Length

35 B

35 chars

Encoding

%-enc

spec

Status

ready

live

input · key/value rows

output · query string

?page=1&sort=-created&filter=active

Quick Start

How to build a query string

Each row maps to a key=value pair. Repeating a key creates ?a=1&a=2.

01
Add rows
Type the key and value. Empty keys are skipped.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
inputIANAregistryofflinelive
key · querypage · IANA
```
page=1
```
loaded · IANA bundlespec · ready
02
Repeat keys
Add the same key twice to keep both — useful for filters.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
repeatRFC 9110canonicalspec-compliantlive
key · optionstag · live
```
tag=a&tag=b
```
options applied · livecanonical
03
Encoding handled
Spaces, commas and unicode are URL-encoded automatically.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
encodevalidationlintpitfallslive
encoded · looked upok · ready
```
q=hello+world
```
result · livevalidated
04
Copy with or without ?
One button for the bare string, one for the prefixed form.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
copyclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
?page=1&sort=-created
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to build a query string

API testing, deep links, analytics.

API testing

Construct paginated or filtered list URLs. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Deep links

Build app deep links with proper encoding. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Analytics UTMs

Assemble utm_source / utm_medium / utm_campaign. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

OAuth flows

Generate authorize URLs with required parameters. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Webhooks

Add tokens and metadata as query params. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Search prefills

Pre-fill search forms via the URL. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

How is encoding done?

Via URLSearchParams, which uses application/x-www-form-urlencoded — the standard for query strings.

Does order matter?

Order can matter for some APIs (e.g. signed requests). We preserve the row order.

What about arrays?

Add the same key multiple times to get ?tag=a&tag=b. PHP-style ?tag[]=a syntax is not generated.

Can I paste an existing string?

Use the URL Parser to break it into rows first.

Is anything sent to a server?

No — encoding runs locally in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!