Why Plus Signs (+) Turn Into Spaces in Query Parameters (And How to Fix It)
Learn why '+' turns into a space in URL query strings. Understand the difference between application/x-www-form-urlencoded and RFC 3986 percent encoding.
According to HTML form submission standards (application/x-www-form-urlencoded), spaces are encoded as '+' instead of '%20'. Consequently, web servers automatically convert all '+' characters back to spaces when parsing query strings. If you want to send a literal plus sign (e.g., in phone numbers '+1415...' or Base64 hashes), you must percent-encode it as '%2B'.
Solve this problem now with our free URL Encoder / Decoder
Try it instantly in your browser — zero tracking, 100% client-side privacy.
Specification & Architecture Reference
| Intended Character | Encoded in Path (RFC 3986) | Encoded in Form Query (W3C Form Spec) | Decoded by Web Server |
|---|---|---|---|
| Space (' ') | %20 | + (Plus sign) | |
| Literal Plus ('+') | + | %2B | |
| Base64 Token ('a+b') | a+b | a%2Bb (Must encode!) |
The Historical Standard Conflict
Why does a plus sign (`+`) represent a space in URLs?
The behavior dates back to early web standards and an architectural distinction between two specifications: 1. **RFC 3986 (URI Generic Syntax):** Defines `%20` as the percent-encoding for a space character. In this standard, `+` is a sub-delimiter that represents a literal plus sign. 2. **W3C HTML Form Specification (`application/x-www-form-urlencoded`):** Standardized how HTML `<form method="GET">` submissions encode fields, specifying that spaces should be replaced with `+` to improve readability.
The Breaking Bug: Phone Numbers & Hashes When sending data like phone numbers or Base64 tokens: ```text https://api.example.com/v1/lookup?phone=+14155552671 ``` The backend parser (in Node, Python, PHP, or Java) treats the `+` as a space, decoding the value as: ```text " 14155552671" ``` This causes database lookups to fail and API calls to return unexpected errors.
The Fix: Always Percent-Encode Literal Pluses To preserve a literal `+`, encode it as **`%2B`**:
const phone = "+14155552671";
const safeUrl = `https://api.example.com/v1/lookup?phone=${encodeURIComponent(phone)}`;
// Produces: "https://api.example.com/v1/lookup?phone=%2B14155552671"The server receives `%2B`, decodes it correctly as `+`, and your phone number or hash remains intact.
Decode and inspect ambiguous URL strings using Mickytool's **URL Encoder / Decoder**.
Solve this problem now with our free URL Encoder / Decoder
Execute this workflow immediately without saving data on remote servers.
Frequently Asked Questions
Should I use %20 or + for spaces in modern REST APIs?
RFC 3986 percent-encoding (%20) is preferred for modern JSON REST APIs, as it works consistently across both path segments and query strings without ambiguity.
Does decodeURIComponent decode '+' to a space?
No! JavaScript's decodeURIComponent('%20') produces a space, but decodeURIComponent('+') returns '+'. To decode form-encoded strings, replace pluses first: decodeURIComponent(str.replace(/\+/g, ' ')).