Query Params ⇄ JSON

Query string and JSON conversion: duplicate keys and nested structures

The structural limits of a query string

A query string models a flat list of key-value pairs, not an object. It looks like this:

?a=1&b=2&list=3&list=4&empty=&flag

Mapping it to JSON requires a few rules to be settled:

The fourth row is the one to watch: when the same parameter appears multiple times, whether the first or the last wins is decided by the server framework. ASP.NET tends to comma-merge, PHP tends to let the later one overwrite, and Node's querystring and URLSearchParams behave differently too. If your API has repeated parameters, confirm how the server handles them first, or you may be bypassed by "parameter pollution" that defeats validation — a classic security-testing technique.

Nested structures: no universal standard

A query string itself has no nesting, but frameworks invented their own syntax, and they are mutually incompatible:

So before converting a nested JSON into a query string, you must confirm which syntax the receiver accepts. This tool performs a flat key-value conversion (repeated keys merge into an array); for nested objects you convert them to dot or bracket form first, or pass the whole thing as a JSON string in one parameter with URL encoding. Forcing a flat conversion onto a nested structure yields key names carrying characters like [, which the other side cannot parse into a hierarchy.

Encoding and common corruption

• Values must be URL-encoded. When a value contains &, =, #, +, or a space, it must be escaped, or it is parsed as a structural character. An unescaped & splits the rest into a new parameter — the most common source of corruption.
• + versus %20. In form-style encoding + means a space, but in a plain URL + is the plus sign itself. Which applies depends on whether the query string came from an HTML form submission or a hand-built URL.
• Double encoding. Seeing %2520 means it was encoded twice (the % itself became %25); decoding once yields %20, and you must decode again to get the space.
• Length limit. Query strings have a real length ceiling (browsers and proxies differ; a conservative figure is around 2 KB, and while Chrome and mainstream servers allow more, do not rely on it). For large data, use a POST body.

How to use the tool

There are two directions: parse a query string like a=1&b=2 into a JSON object (repeated keys are merged into arrays automatically), or join a flat object into a query string. You do not need to include the leading ?; if present it is ignored.

This is especially handy while debugging: copy request parameters from the Network panel of your dev tools, convert them to JSON, and compare two requests directly; or convert a parameter object back into a query string to paste into curl or the browser address bar.