Why does a plus sign become a space in a query value?

Measured inputs and outputs

These are locally constructed test strings, not evidence that Claude inserts these characters. We executed the saved homepage script snapshot with a minimal DOM harness and compared exact strings. The invisible-checkbox state and dash mode appear in each row. The observations below test this page's specific question. Three destination checks use separately recorded browser observations; those pages explain the distinction. We make no detector-score or statistical-watermark removal claim.

The query parser changes the representation

The raw-plus fixture contains the ASCII characters q, equals, A, plus and B. The observer reads its q value as A space B both before and after cleaning. The percent-encoded plus instead becomes A plus B. Neither input includes a selected character, so cleanup reports no removal. The encoded marker also survives cleanup as literal percent signs and hexadecimal letters, then becomes U+200B when the query parser decodes it. Only the literal-marker fixture loses its U+200B before that parser runs. These four rows keep decoding separate from character deletion.

A value differs from a query key

Our earlier query guide concerned exact key lookup and duplicate parameter names. This experiment holds the key q constant and measures only the value representation. URLSearchParams uses form-style parsing, where the handling of plus has a specific meaning. The homepage does not know that its input is a serialized query and performs no percent decoding. The saved observer runs locally without sending a request. No server framework, form submission or browser address-bar behavior was measured, and an accepted parsed value is not evidence that an application received the intended data.

Choose the layer you intend to edit

Keep the original serialized query and inspect the decoded value independently. If a plus is intended as data, construct the query with URLSearchParams rather than guessing the correct spelling by hand. If a selected invisible character is unwanted inside a value, inspect and deliberately edit that decoded value, then serialize it through the query builder. Cleaning the entire encoded query cannot remove a code point that has not been decoded yet. Compare the destination value after serialization and parsing, and avoid interpreting a no-findings message as proof that every decoded parameter is free of invisible characters.

Reproduce this test

Save reproduce.cjs and tested-app.js in the same folder. Run the command below with Node.js. The harness prints its runtime, script SHA-256 and every measured row. Compare those rows with the original record. Using a newer script or runtime creates a new experiment; retain the version information with your rerun.

node reproduce.cjs