Why a plus sign becomes a space in a query string

Decision reference

Distinguish percent decoding from form parsing

decodeURIComponent handles percent escapes without turning plus into space. URLSearchParams follows form-style query rules, where plus represents a space. The same visible query text can therefore produce different results in the two operations. Our decoder includes an explicit plus-as-space option for inspecting that convention, rather than pretending every URL-related string has identical decoding semantics.

Protect a literal plus

A literal plus should be encoded as %2B when sent through form-style handling. Raw C++ in a query may become C followed by two spaces. A space itself may be represented as plus or %20 depending on the encoder. Use a query builder with raw values or encode the component once. Replacing all plus characters after parsing can also damage real spaces and does not recover intent reliably.

Base64 is vulnerable at this boundary

Standard Base64 includes plus in its alphabet. Joining it directly into a query can turn those symbols into spaces at the receiver. Percent-encode the value or use the URL-safe variant when the protocol requires it. Do not remove every space to make a broken token parse unless you know the exact source transformation. That may hide a transport bug and leave other values corrupted.

Trace a synthetic value end to end

Record the raw value, constructed request URL and server-parsed result with test data. Find the first point where the result differs. Frontend code, a query builder and backend parsing may each contribute a transform. Fix the incorrect boundary rather than adding compensating replacements everywhere. Include plus, space and percent in a regression fixture to catch related double-encoding mistakes.

Worked example: literal plus preservation

Use this exact sample to isolate the behavior discussed above. Keep the operation and options with the sample when reporting a result; changing the input representation can change what the test demonstrates.

Input or question

Original: C++
Query value: C%2B%2B

Expected result or interpretation

Parsed with form rules: C++
Raw C++ commonly becomes C followed by two spaces.

One fixture should contain both meanings

Use the raw value "C++ tips" in a query construction test. The two literal plus signs need to survive as plus signs, while the space must recover as a space. Component encoding gives C%2B%2B%20tips. A form-oriented serializer may spell the space with plus instead, while still escaping the literal plus signs. Both can be correct if the receiver follows the corresponding rules. Assert the final parsed value, not one preferred visual spelling of the URL. This avoids rejecting a valid serializer or accepting a broken one based only on whether the address contains + or %20. Keep the raw value and serialized component in separate columns.

Keep literal and encoded inputs in separate columns

An investigation table should show raw application value, serialized query component and parsed server value. For C++, the raw column contains plus signs and the serialized component should contain %2B sequences. If the raw column already contains percent escapes, clarify whether it is truly raw data or an intermediate representation. This simple distinction prevents a teammate from adding another encoding pass while trying to repair a plus problem.

For form-style handling, include both a literal space and a literal plus in the same fixture. The receiver must recover each as intended. Also include a percent sign so a compensating decoder does not accidentally interpret unrelated content. The tool’s plus-as-space checkbox is only a diagnostic option; it is not a replacement for parsing the whole query string correctly. A complete query can contain repeated parameters, empty values and separators that need a query-aware API. Preserve the exact value after parsing rather than guessing how the browser’s displayed address corresponds to network bytes. Once the first incorrect layer is identified, remove the duplicate or missing conversion there and add an end-to-end assertion. That is more reliable than a collection of replacements that merely make the current sample look right.

Verification cases

• C++ and a space: Verify both literal plus and space survive their intended handling.
• a+b with generic decoder: Plus remains literal.
• a+b with form convention: Plus is interpreted as a space.

Before you use the result

1. Identify the query parser’s convention.
2. Encode literal plus as %2B.
3. Keep the tool option explicit.
4. Fix the first incorrect transform.

Continue the workflow

encodeURI vs encodeURIComponent: encode the right boundary addresses encode query values without breaking urls. Base64url and padding: why tokens use a different alphabet addresses convert base64 and base64url text.