HTML Forms: GET versus POST
See what each form method sends over HTTP and when to use it.
On this page
The concept
A form sends its fields to the address in action using the HTTP method in method. With GET the fields are added to the URL as a query string, so the form below requests /search?q=tcp. GET is for reading data: the URL can be bookmarked, cached, and shared, but it is also stored in history and server logs, so it must not carry secrets. With POST the fields travel in the request body, which is for actions that change something on the server and for sensitive values such as passwords. POST requests are not cached or bookmarked by default.
Code example
<form action="/search" method="get">
<label for="q">Search</label>
<input id="q" name="q" value="tcp">
<button type="submit">Search</button>
</form>
<form action="/login" method="post">
<input name="user" autocomplete="username">
<input name="password" type="password" autocomplete="current-password">
<button type="submit">Log in</button>
</form>Follow the code
Open the walkthrough to inspect the example one step at a time.
Show guided walkthrough
<form action="/search" method="get"> <label for="q">Search</label> <input id="q" name="q" value="tcp"> <button type="submit">Search</button></form> <form action="/login" method="post"> <input name="user" autocomplete="username"> <input name="password" type="password" autocomplete="current-password"> <button type="submit">Log in</button></form>Follow the example
Start to inspect the source, values, and output. These prepared steps explain the published sample; grouped loop steps describe multiple iterations.
View the complete dry-run table
| Step / line | What happens | State after step | Output so far |
|---|---|---|---|
| GET puts the fields in the URL: the browser requests /search?q=tcp. | — | — | |
| The name attribute becomes the parameter name in the query string. | — | — | |
| POST sends the fields in the request body instead of the URL. | — | — | |
| Passwords must never be sent with GET. type=password hides the characters on screen. Use HTTPS so the body is encrypted in transit. | — | — |
Behind the scenes
How HTML processes this code
The browser parses HTML into a document tree and renders its elements. HTML does not execute as a sequence of program statements.