How do I pass an array as a query parameter?

There is no standard. Repeated keys (tags=a&tags=b) is the most widely understood, bracket notation (tags[]=a) suits PHP and Rails, and comma-joined values suit some APIs. Match what your server parses.

Should a space be + or %20?

Both appear: + is the form-urlencoded convention and is correct in a query string, while %20 is valid everywhere in a URL. Use %20 if you are unsure — every parser accepts it.

Can I put a URL inside a query parameter?

Yes, fully percent-encoded. Encoding the whole value is essential, otherwise its own ? and & merge into the outer query string.

Is there a maximum query string length?

No protocol limit, but proxies, servers and older browsers impose practical caps around 2,000–8,000 characters. Use a POST body for large payloads.

URL & Links🌐 YAS server-sideAPI availablebeginner

Query String Builder

Builds a URL with query parameters safely — correct encoding, no manual mistakes.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

Base URL

Params (one per line, key=value)

Loading tool…

What does this tool do?

Builds a URL with query parameters safely — correct encoding, no manual mistakes.

Why would I use it?

You need a URL with several parameters and want them encoded correctly.
You are constructing links in scripts or docs.
You want to avoid broken queries from unencoded values.

Real-life example

Input

base: https://api.example.com/search, params: { q: "hello world", page: 2 }

Output

https://api.example.com/search?q=hello%20world&page=2

Values are percent-encoded automatically.

Input → Process → Output → Next

Input: Enter the base URL and key/value pairs.
Process: YAS encodes and assembles the query string.
Output: The final URL.
Next action: Test it in your browser or API client.

Common mistakes

Encoding the whole URL instead of just values.
Duplicate parameter names where the API expects arrays.
Using unencoded special characters like & inside values.

What the result means

The output is a correctly encoded query string.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/query-string-builder

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/query-string-builder" \
  -H "Content-Type: application/json" \
  -d '{"base":"https://example.com","params":{"a":"1","b":"2"}}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/query-string-builder", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "base": "https://example.com",
  "params": {
    "a": "1",
    "b": "2"
  }
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/query-string-builder", json={"base":"https://example.com","params":{"a":"1","b":"2"}})
data = r.json()

Field	Type	Required	Description
base	string	Yes	Base URL
params	object	No	Query params to append

Success response

{ "result": "https://example.com/?a=1&b=2", "paramsAdded": 2 }

Build a URL with query parameters safely.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How Query String Builder works

The builder assembles a query string using URLSearchParams semantics: each key and value is percent-encoded according to the application/x-www-form-urlencoded rules, pairs are joined with &, and the result is appended after ? — or after & when the base URL already carries a query string. Encoding a value is what keeps a stray &, = or # inside it from being read as structure.

Two conventions differ from plain percent-encoding and catch people out. Space is encoded as + rather than %20 in the form-urlencoded serialization, and repeated keys are legal: a=1&a=2 is not a duplicate to be resolved but an ordered list, which frameworks variously expose as an array, as the first value, or as the last. There is no standard, so the receiving side's behaviour has to be known rather than assumed.

When to use it: real-world scenarios

Constructing an API request by hand

Building a filter or pagination query correctly the first time avoids the encoding bugs that appear only when a value contains a space or an ampersand.

Assembling a link with user-supplied text

Search terms, names and free text routinely contain characters that break an unencoded query string.

Reproducing a request seen in logs

Rebuilding the exact parameter set is how you confirm whether a failing request is malformed or genuinely rejected.

Creating prefilled form links

Support and onboarding flows often prefill fields from query parameters; encoding correctly ensures the values arrive intact.

Pro tips

Encode values, never separators. Encoding the & or = between pairs produces one parameter with a bizarre name.
Decide how arrays are represented and match the server: repeated keys (a=1&a=2), bracket notation (a[]=1) and comma-joined values are all in use and none is universal.
Keep query strings short. Proxies and older browsers impose practical URL length limits around 2,000 characters, and encoding inflates values.
Never put secrets in a query string. URLs are logged by servers, proxies and analytics, and are sent in the Referer header.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Serialization only — the tool does not know your server's parsing rules for repeated keys or nested structures.
Nested objects have no standard query-string representation; bracket and dot notations are framework conventions.
The + versus %20 distinction depends on whether the consumer expects form-urlencoded or RFC 3986 semantics.
Very long strings may exceed limits imposed somewhere in the request path, with no error until it fails.

Frequently asked questions

How do I pass an array as a query parameter?: There is no standard. Repeated keys (tags=a&tags=b) is the most widely understood, bracket notation (tags[]=a) suits PHP and Rails, and comma-joined values suit some APIs. Match what your server parses.
Should a space be + or %20?: Both appear: + is the form-urlencoded convention and is correct in a query string, while %20 is valid everywhere in a URL. Use %20 if you are unsure — every parser accepts it.
Can I put a URL inside a query parameter?: Yes, fully percent-encoded. Encoding the whole value is essential, otherwise its own ? and & merge into the outer query string.
Is there a maximum query string length?: No protocol limit, but proxies, servers and older browsers impose practical caps around 2,000–8,000 characters. Use a POST body for large payloads.

Related tools

URL Encoder UTM Builder URL Parser