URL Encoding in Postman and curl

API testing tools like Postman and curl are the daily drivers for developers hitting REST APIs. Both have opinions about when to encode URL parameters and when to leave them raw — and the defaults aren't always obvious. Send an unencoded ampersand in a query value and your request silently breaks. Send a double-encoded value and the API receives garbled input.

Here's how encoding works in each tool and how to stay in control of it.

How Postman Handles URL Encoding

Postman has two ways to add query parameters:

Params table (recommended): When you add key-value pairs in the Params tab, Postman encodes the values automatically before sending. Type coffee & tea as a value and Postman sends coffee%20%26%20tea. The URL preview in the address bar shows the encoded version.

Direct URL bar entry: If you type or paste a full URL with query parameters directly into the address bar, Postman does NOT re-encode existing content. Whatever you paste is sent as-is. If the URL contains unencoded special characters, they go out raw.

To verify what's actually being sent: open the Console (View menu) and inspect the raw request. The "Request URL" line shows the exact bytes that left Postman.

How curl Handles URL Encoding

curl does not encode query parameter values automatically. If you pass a URL with special characters in parameter values, curl sends them exactly as you typed them:

# This sends the & unencoded — server may misparse it
curl "https://api.example.com/search?q=coffee & tea"

# Correct: manually encode the value
curl "https://api.example.com/search?q=coffee%20%26%20tea"

For POST data, curl has --data-urlencode which encodes a value for you:

# Encodes the value automatically
curl -G --data-urlencode "q=coffee & tea" https://api.example.com/search

# Equivalent to: /search?q=coffee%20%26%20tea

-G appends the data as a GET query string rather than a POST body. This is the cleanest way to build encoded query strings in curl scripts.

Sell Custom Apparel — We Handle Printing & Free Shipping

Pre-Encoding Values Before Pasting Into Tools

When you're testing an API with complex values — JSON snippets, multi-word search queries, email addresses, special characters — the fastest workflow is:

1. Paste the raw value into the Mongoose URL Encoder
2. Click Encode to get the percent-encoded version
3. Paste the encoded value directly into the Postman URL bar or a curl command

This is especially useful when you can't use the Params table (for example, when the API uses non-standard query string formats, or when you're working from a pre-built URL template).

Common Encoding Bugs in Postman and curl

Pasting an already-encoded URL into Postman Params table: If you paste q=hello%20world into the Value column of the Params table, Postman encodes it again and sends q=hello%2520world. Paste into the URL bar directly instead, or paste the decoded value into the Params table and let Postman encode it.

curl with spaces in the URL: Shell word-splitting breaks curl commands with unquoted URLs containing spaces. Always quote curl URLs: curl "https://example.com/search?q=hello world" — but note the space will be sent unencoded unless you also encode it.

Postman environment variables: Values stored in Postman variables are not automatically encoded when inserted into URLs via {{variable}} syntax. Pre-encode sensitive values or use the Params table to handle encoding.

Frequently Asked Questions

Does Postman encode the entire URL or just the query values?

When using the Params table, Postman encodes only the query parameter values — not the base URL, path, or the parameter keys. This is the correct behavior. Encoding the path separators or the scheme would break the URL.

How do I see what Postman actually sent?

Open View > Show Postman Console (or Ctrl/Cmd+Alt+C). After sending the request, click it in the console to see the raw request URL and headers. The "Request URL" field shows the exact encoded URL that was transmitted.

Can curl decode URL-encoded strings?

Not natively in the CLI. Use Python: python3 -c "import urllib.parse; print(urllib.parse.unquote('your%20string'))" — or paste it into the Mongoose URL Encoder decoder.

Should I encode the colon in https:// when building curl commands?

No. The scheme, domain, path separators, and query string delimiter (?) should not be encoded — they are structural parts of the URL. Only encode the values that go inside parameters.