action chooses the request URL. method chooses how the browser sends the named values.

Use GET when submitting the form reads information:

<form action="/search" method="get">
  <label for="query">Search</label>
  <input id="query" name="q">
  <button type="submit">Search</button>
</form>

Entering forms navigates to a URL such as /search?q=forms. That URL can be copied, bookmarked, revisited, and indexed. This makes GET a good fit for searches and filters.

Use POST when the request changes server state:

<form action="/account/email" method="post">
  <label for="email">New email address</label>
  <input id="email" name="email" type="email" required>
  <button type="submit">Update email</button>
</form>

The browser puts the encoded values in the request body. The URL alone no longer describes the operation.

POST is not automatically private or secure. HTTPS protects both URLs and bodies while they travel across the network. Server logs and application code can still expose carelessly handled data.

Do not use GET for an action such as deleting a record. Browsers, crawlers, previews, and caches may follow GET links because GET is expected to be safe.

Submit one GET form and one POST form with DevTools open. Compare the request URL and payload.