PlayInfoBox

Home /Text /URL Query Strings Explained: How to Read and Build One

URL Query Strings Explained: How to Read and Build One

That block of text after the "?" in a URL is not random β€” it follows a strict, readable structure once you know the pattern.

It starts with a ? and separates params with &

In https://example.com/search?q=cats&sort=new, everything after "?" is the query string, and "&" separates the individual key=value pairs.

Each parameter is a key=value pair

q=cats means the parameter named "q" has the value "cats." Order generally does not matter, and a URL can carry any number of parameters this way.

Special characters get percent-encoded

Characters with special meaning in a URL β€” space, &, =, ?, and non-ASCII characters β€” get converted into a %XX hex code. A space becomes %20 or +, so "new york" becomes "new%20york."

The same key can appear more than once

Some systems use repeated keys (tag=cat&tag=dog) or bracket notation (tag[]=cat&tag[]=dog) to represent a list-style value. How it gets interpreted depends on the specific backend or framework, not a universal URL rule.

UTM parameters are just query string params with a marketing convention

utm_source, utm_medium, and utm_campaign are not a special URL feature β€” they are an informal naming convention that analytics tools like Google Analytics agree to read, added onto a URL as ordinary query parameters.

Why query strings exist

They let a single URL or page carry variable data without needing a separate page for every possible state. Search results, filters, pagination, tracking, and API requests all rely on this to pass parameters through the URL rather than requiring the server to guess. It is also why bookmarking or sharing a specific filtered view works, since that state lives directly in the URL itself.

Building one by hand

To construct a query string, join each key=value pair with "&", percent-encode any special characters within each key or value first, then prepend "?" before appending the whole thing to a base URL. Getting the encoding step right is the most common source of a broken link, especially with spaces or non-ASCII text.

Frequently Asked Questions

Is a query string visible, and is it secure?

It is fully visible in the browser address bar, browser history, server logs, and often in the "Referer" header sent to other sites. It should never be used to pass sensitive information like a password, and it is not "secure" just because the connection runs over HTTPS.

What is the difference between a query string and a URL path?

The path (like /products/shoes) usually identifies a specific resource in a fairly fixed, hierarchical way. The query string (?color=red&size=10) is meant for optional, variable parameters that filter or modify that resource, avoiding the need for a completely separate path for every possible combination.