Query String Parser

How it works

In Parse mode, the tool extracts everything after the first "?" (dropping any "#" fragment), splits on "&" and "=", and decodes each key and value with decodeURIComponent, treating "+" as a space. In Build mode, key/value rows are joined with encodeURIComponent to produce a safely percent-encoded query string.

Benefits

• Handles full URLs or bare query strings automatically
• Safe decoding that reports errors instead of throwing
• Flags parameter names that commonly carry tokens or secrets
• Build mode for constructing a query string from scratch

Use cases

• Debug OAuth redirect URIs and callback parameters
• Inspect UTM tracking parameters on a marketing link
• Build a query string for an API request by hand
• Decode encoded values shared in bug reports or logs

Best practices

• Avoid putting real tokens or secrets in URLs—they get logged by servers and proxies
• Use Build mode to guarantee correct percent-encoding instead of hand-editing strings
• Double-check flagged sensitive-looking parameters before sharing a parsed URL
• Prefer POST bodies over query strings for sensitive data where possible

Common mistakes

• Assuming query string values are safe to log or share verbatim
• Forgetting that '+' represents a space in form-encoded query strings
• Manually encoding special characters instead of using encodeURIComponent
• Missing duplicate parameter names that should be treated as a list

Privacy

Parsing and building both run locally using built-in JavaScript encoding functions—no network request is made and your URL is not sent to ToolHub.