URL Query Parameter Editor

A URL query is the part after ? : name=value pairs joined by &

In a web address, the query runs from the first ? up to a #. In https://shop.example.com/products?color=white&size=9.5 the query is color=white&size=9.5: two pairs split by &, with the names color and size and the values white and 9.5. Queries carry things like a search phrase, a page number, filter choices or advertising tags to the server or script behind the page. What each name means is decided by each site.

This tool splits the query of a pasted URL into a name and value table and rebuilds the URL as you edit. Percent-encoded text is shown as readable characters, and pairs you do not touch keep their original spelling. Tracking parameters added by ad and analytics companies are flagged only when their official documentation confirms them, and you can strip them in one click. It also shows which value PHP, Python, Java and other servers read when the same name appears more than once. The URL you paste never leaves your browser.

When you need to see a query as a table

• Before sharing a link: links from ads and newsletters often end in a long tail of utm_source, gclid or fbclid. Without it the URL is shorter, and an ID that points to one ad click or one email recipient is not reused for someone else's visit.
• Building or checking campaign links: you can see at a glance whether utm_source, utm_medium and utm_campaign are spelled right and whether a name appears twice. '+ UTM' adds the three as empty rows.
• Checking an API request URL: change one value and resend, or see how an empty value and a name without = are passed on. The result can also be copied as JSON.
• Fixing a return URL after login or checkout: the address inside redirect_uri or next is encoded a second time and hard to read. 'Open as table' lets you edit the inner URL separately and put it back into the outer one.
• Checking that filters reach the server: PHP reads color=white&color=black as one value (the last), while Python reads a list of two. You can compare what the server really receives.
• Reading URLs from access logs: server logs and analytics keep search terms and filters encoded. Decode them item by item.

How to use it

1. Paste: put a full URL (https://…), a query starting with ?, or just name=kim&page=2 into 'Original URL'. The query is split into a name and value table, and the start of the URL and the part after # get their own boxes.
2. Strip tracking: in the length bar, striped cells are click and visitor IDs and light orange cells are campaign tags. 'Remove click IDs' takes out only IDs such as gclid and fbclid. 'Remove all tracking' also removes campaign tags such as UTM. 'Undo' brings them back right away.
3. Edit the table: type values as plain, unencoded text. Enter moves to the next cell and adds a new row on the last line (Shift+Enter makes a line break inside a value). × removes a row, 'Sort by name' sorts, and 'Reset' goes back to the start.
4. Open a URL inside a value: when a value is a URL, 'Open as table' appears in the flags column. Edit the inner URL the same way, then press 'Back to outer URL' to put it into the outer value.
5. Copy: copy the rebuilt URL as a full URL, query only or JSON. Edited items are underlined. You also choose whether edited spaces are written as + or %20, and whether untouched items keep their original spelling.
6. See what the server reads: click a row and the cards below show how eight environments read that name. The color on the left of each card is the way it reads (first value, last value, list, comma-joined, dropped).

The characters that split a query

The query parsing rules of the WHATWG URL Standard (application/x-www-form-urlencoded) cut the query at &, split each piece at its first = into a name and a value, turn + into a space, turn %XX back into bytes and read them as UTF-8. The browser's URLSearchParams follows exactly this, and so does this tool when it builds the table.

A bare flag with no equals sign is read as an item with an empty value, the same as flag=, and an empty piece such as && is skipped. The HTML 4.01 specification recommended that servers accept ; in place of &, but today's URL Standard and Python's parse_qs use & only. Go treats a pair that contains ; as invalid and drops it.

How names and values are read

Values written in an old, non-UTF-8 encoding look garbled in the table. If you do not edit such an item, 'Keep original notation' leaves the original bytes alone, so the rebuilt URL still opens as before. To see what the garbled characters were, use the encoding auto-detection in the URL Encoder / Decoder.

Tracking parameters: what is safe to remove

A tracking parameter has nothing to do with the page content. It tells the site which ad, email or campaign a visitor came from. Without it the same page usually opens, but the site owner can no longer tell where that visit came from. The tool flags only names confirmed in official company documentation and sorts them into two groups.

• Click and visitor IDs (striped cells in the bar): values that point to one ad click, one email recipient or one visit. There is no reason to pass them on, so it is better to remove them before sharing.
• Campaign tags (light cells): labels that say which source, medium and campaign a link belongs to. Keep them on campaign links you build yourself. When you forward someone else's link, you may remove them.

Values with no official explanation, such as si on YouTube share links and igsh on Instagram share links, are not in the list. If you know what they do and want them gone, press × on the row. Names that only look similar, such as ref, source and from, are left alone because some sites use them for page content.

The same name twice: servers read it differently

When a name repeats, as in tag=red&tag=blue, the URL Standard keeps both items in order. Which value the code uses afterwards is up to the language or framework on the receiving end, and they differ. Many shops send several values on purpose for filters, so a server that reads only one value loses part of the selection.

PHP reads tag[]=red&tag[]=blue, with brackets after the name, as an array, and turns dots and spaces in a name into underscores. So price.min=10000 becomes $_GET['price_min'] and can collide with a separate price_min item. Python's parse_qs drops empty values by default, so flag and empty= leave no key at all; pass keep_blank_values=True to keep them. Go drops any pair that contains ; or a bad %. 'What the server reads', below the tool, works out these differences for the item you click.

Putting another URL inside a value

When a whole URL goes into a value, as with redirect_uri, next or returnUrl, the ? & = # of the inner URL must all be encoded so they are not read as characters of the outer query. If you paste it unencoded, everything after the inner & becomes a separate item of the outer URL.

If the inner URL has encoded values of its own, they are encoded once more and look like %252F. 'Open as table' shows the inner URL, with one layer removed from the outer value, as a separate table. After you edit it, 'Back to outer URL' encodes it again and puts it back. In the 'Login redirect' example, the redirect_uri holds one more layer: next=%2Fcart.

What changes when the URL is rebuilt

The same query can be written in several ways. A space as + or %20, flag or flag=, hex digits in upper case %C3 or lower case %c3 are all read as the same value. Most servers do not care, but a signed URL may stop working, depending on the server, if it is written differently from how it was signed. That is why 'Keep original notation' is on by default and only edited items are re-encoded.

The + rule is how HTML forms and URLSearchParams write spaces, and the %20 rule is how JavaScript's encodeURIComponent() does. The browser's URLSearchParams rewrites every item even when you delete only one, so %20 turns into + (see the code below). Signed URLs, such as an AWS S3 presigned URL (X-Amz-Signature) or an Azure Storage SAS (sig), must not be edited; you need a new signature instead. The tool warns you when you edit a URL that carries a signature.

Doing it in code

// JavaScript
const u = new URL('https://shop.example.com/p?color=white&color=black&q=red%20shoe&utm_source=newsletter');
u.searchParams.getAll('color');     // ['white', 'black']
u.searchParams.delete('utm_source');
u.toString();  // 'https://shop.example.com/p?color=white&color=black&q=red+shoe'  (%20 became +)

# Python
from urllib.parse import urlsplit, parse_qsl, urlencode, urlunsplit
s = urlsplit('https://shop.example.com/p?color=white&color=black&flag&utm_source=newsletter')
pairs = [(k, v) for k, v in parse_qsl(s.query, keep_blank_values=True) if not k.startswith('utm_')]
urlunsplit(s._replace(query=urlencode(pairs)))
# 'https://shop.example.com/p?color=white&color=black&flag='  (flag became flag=)

// PHP
parse_str('tag=red&tag=blue&size[]=S&size[]=M&price.min=10000', $q);
// $q = ['tag' => 'blue', 'size' => ['S', 'M'], 'price_min' => '10000']
http_build_query(['tag' => ['red', 'blue']]);
// 'tag%5B0%5D=red&tag%5B1%5D=blue'

All three parse the query and write it out again, so none of them keeps the original spelling. If the original spelling matters, cut the pieces you want out of the query string and join the rest yourself. That is what 'Keep original notation' does in this tool.

Common mistakes

• Typing %20 into a value cell: values in the table are decoded text. If you type %20, the tool sees the characters %, 2 and 0 and sends out %2520. Type a plain space.
• Pasting C++ straight into a query: lang=C++ is read as 'C' plus two spaces. If you type C++ into a value cell, the tool writes it as C%2B%2B.
• Deleting a repeated name as if it were an error: color=white&color=black may be a filter with several choices. Check how the server reads it first.
• Deleting items with an empty value: empty= or flag can still mean something. Some servers switch a feature on just because the item exists.
• Treating what follows # as query: the x=1 in /page#tab?x=1 is part of the fragment, is not sent to the server, and the tool keeps it in the fragment box.
• Forgetting to encode a URL inside a value: the & of the inner URL splits the outer item in two.
• Only extending the expiry of a signed URL: changing X-Amz-Expires breaks the signature, and the request is rejected.

Limits

• The tool splits the query only at &, as the URL Standard does. Sites that split items with ; or ,, and parameters inside the path (/a;b=1/), are not split.
• Values are decoded as UTF-8 only. Values in older encodings look garbled, and editing such an item re-encodes it as UTF-8.
• The start of the URL (scheme, host, path) and the # fragment are handled as written and are neither encoded nor cleaned up.
• Even with 'Keep original notation', changing any item drops empty pieces (&&) and a trailing &.
• Only tracking parameters confirmed in official documentation are flagged. Any tracking value not on the list you have to remove yourself.
• 'What the server reads' shows each environment's default behavior. Changing settings or using another parser (qs, Rack and so on) changes the result, and limits such as PHP's max_input_vars are not reflected.
• The tool never connects to the URL, so it does not check whether the address opens or is safe.

Basis: query parsing follows the application/x-www-form-urlencoded rules of the WHATWG URL Standard, tracking parameters come from each company's official help pages, and per-server behavior was checked on October 22, 2026 against runs of PHP 8.5, Python 3.14 and Node.js 26 and the official documentation of Java Servlet, Go, ASP.NET Core, Django and Express 5.

Sources

• 01WHATWG URL Standard: application/x-www-form-urlencodedSplitting at &, the first =, + as a space, percent-decoding and serialization
• 02MDN: URLSearchParamsget, getAll, delete, toString
• 03Google Analytics Help: Collect campaign data with custom URLsMeaning of the nine utm parameters
• 04Google Ads Help: Google Click Identifier (GCLID)The value auto-tagging adds to every ad click
• 05Google Ads Help: gbraid and wbraidParameters for iOS conversion measurement
• 06Google Ads Help: gad_source and gad_campaignidAd source and campaign ID
• 07Google tag: cross-domain measurementThe linker parameter _gl
• 08Meta: fbp and fbc parametersThe click ID added to links (fbclid)
• 09Ad and email company documentation: dclid · srsltid · Microsoft click ID · ttclid · twclid · li_fat_id · mc_cid, mc_eid · _hsenc, _hsmi · yclid · Matomo · NaPmOfficial explanation from the company that adds each parameter
• 10PHP: Variables From External SourcesDots and spaces in names become underscores; [] arrays
• 11Python: urllib.parse.parse_qskeep_blank_values defaults to False; only & separates
• 12Django: QueryDict__getitem__ returns the last value, getlist returns all
• 13Express 5: app settings (query parser)The default "simple" is Node querystring
• 14Java EE: ServletRequest.getParameterWith several values, the first of getParameterValues
• 15Go: net/urlValues.Get returns the first value; a pair with ; is invalid
• 16.NET: StringValues.ToStringSeveral values joined with commas into a string
• 17HTML 4.01 Appendix B.2.2The old recommendation to accept ; instead of &

Frequently asked questions

Related tools