diff --git a/esphome/components/captive_portal/captive_portal.cpp b/esphome/components/captive_portal/captive_portal.cpp
index 8d88a10b27..5af6ab29a2 100644
--- a/esphome/components/captive_portal/captive_portal.cpp
+++ b/esphome/components/captive_portal/captive_portal.cpp
@@ -47,8 +47,8 @@ void CaptivePortal::handle_config(AsyncWebServerRequest *request) {
   request->send(stream);
 }
 void CaptivePortal::handle_wifisave(AsyncWebServerRequest *request) {
-  std::string ssid = request->arg("ssid").c_str();  // NOLINT(readability-redundant-string-cstr)
-  std::string psk = request->arg("psk").c_str();    // NOLINT(readability-redundant-string-cstr)
+  const auto &ssid = request->arg("ssid");
+  const auto &psk = request->arg("psk");
   ESP_LOGI(TAG,
            "Requested WiFi Settings Change:\n"
            "  SSID='%s'\n"
@@ -56,10 +56,10 @@ void CaptivePortal::handle_wifisave(AsyncWebServerRequest *request) {
            ssid.c_str(), psk.c_str());
 #ifdef USE_ESP8266
   // ESP8266 is single-threaded, call directly
-  wifi::global_wifi_component->save_wifi_sta(ssid, psk);
+  wifi::global_wifi_component->save_wifi_sta(ssid.c_str(), psk.c_str());
 #else
   // Defer save to main loop thread to avoid NVS operations from HTTP thread
-  this->defer([ssid, psk]() { wifi::global_wifi_component->save_wifi_sta(ssid, psk); });
+  this->defer([ssid, psk]() { wifi::global_wifi_component->save_wifi_sta(ssid.c_str(), psk.c_str()); });
 #endif
   request->redirect(ESPHOME_F("/?save"));
 }
diff --git a/esphome/components/web_server/web_server.cpp b/esphome/components/web_server/web_server.cpp
index de4da99e00..21f7a90b07 100644
--- a/esphome/components/web_server/web_server.cpp
+++ b/esphome/components/web_server/web_server.cpp
@@ -1175,13 +1175,13 @@ void WebServer::handle_date_request(AsyncWebServerRequest *request, const UrlMat
 
     auto call = obj->make_call();
 
-    // .c_str() is required for Arduino framework where arg() returns Arduino String instead of std::string
-    std::string value = request->arg(ESPHOME_F("value")).c_str();  // NOLINT(readability-redundant-string-cstr)
-    if (value.empty()) {
+    const auto &value = request->arg(ESPHOME_F("value"));
+    // Arduino String has isEmpty() not empty(), use length() for cross-platform compatibility
+    if (value.length() == 0) {  // NOLINT(readability-container-size-empty)
       request->send(409);
       return;
     }
-    call.set_date(value.c_str(), value.size());
+    call.set_date(value.c_str(), value.length());
 
     DEFER_ACTION(call, call.perform());
     request->send(200);
@@ -1236,13 +1236,13 @@ void WebServer::handle_time_request(AsyncWebServerRequest *request, const UrlMat
 
     auto call = obj->make_call();
 
-    // .c_str() is required for Arduino framework where arg() returns Arduino String instead of std::string
-    std::string value = request->arg(ESPHOME_F("value")).c_str();  // NOLINT(readability-redundant-string-cstr)
-    if (value.empty()) {
+    const auto &value = request->arg(ESPHOME_F("value"));
+    // Arduino String has isEmpty() not empty(), use length() for cross-platform compatibility
+    if (value.length() == 0) {  // NOLINT(readability-container-size-empty)
       request->send(409);
       return;
     }
-    call.set_time(value.c_str(), value.size());
+    call.set_time(value.c_str(), value.length());
 
     DEFER_ACTION(call, call.perform());
     request->send(200);
@@ -1296,13 +1296,13 @@ void WebServer::handle_datetime_request(AsyncWebServerRequest *request, const Ur
 
     auto call = obj->make_call();
 
-    // .c_str() is required for Arduino framework where arg() returns Arduino String instead of std::string
-    std::string value = request->arg(ESPHOME_F("value")).c_str();  // NOLINT(readability-redundant-string-cstr)
-    if (value.empty()) {
+    const auto &value = request->arg(ESPHOME_F("value"));
+    // Arduino String has isEmpty() not empty(), use length() for cross-platform compatibility
+    if (value.length() == 0) {  // NOLINT(readability-container-size-empty)
       request->send(409);
       return;
     }
-    call.set_datetime(value.c_str(), value.size());
+    call.set_datetime(value.c_str(), value.length());
 
     DEFER_ACTION(call, call.perform());
     request->send(200);
@@ -2004,11 +2004,11 @@ void WebServer::handle_infrared_request(AsyncWebServerRequest *request, const Ur
 
     // Parse base64url-encoded raw timings (required)
     // Base64url is URL-safe: uses A-Za-z0-9-_ (no special characters needing escaping)
-    // .c_str() is required for Arduino framework where arg() returns Arduino String instead of std::string
-    std::string encoded = request->arg(ESPHOME_F("data")).c_str();  // NOLINT(readability-redundant-string-cstr)
+    const auto &data_arg = request->arg(ESPHOME_F("data"));
 
     // Validate base64url is not empty (also catches missing parameter since arg() returns empty string)
-    if (encoded.empty()) {
+    // Arduino String has isEmpty() not empty(), use length() for cross-platform compatibility
+    if (data_arg.length() == 0) {  // NOLINT(readability-container-size-empty)
       request->send(400, ESPHOME_F("text/plain"), ESPHOME_F("Missing or empty 'data' parameter"));
       return;
     }
@@ -2017,7 +2017,7 @@ void WebServer::handle_infrared_request(AsyncWebServerRequest *request, const Ur
     // it outlives the call - set_raw_timings_base64url stores a pointer, so the string
     // must remain valid until perform() completes.
     // ESP8266 also needs this because ESPAsyncWebServer callbacks run in "sys" context.
-    this->defer([call, encoded = std::move(encoded)]() mutable {
+    this->defer([call, encoded = std::string(data_arg.c_str(), data_arg.length())]() mutable {
       call.set_raw_timings_base64url(encoded);
       call.perform();
     });
diff --git a/esphome/components/web_server/web_server.h b/esphome/components/web_server/web_server.h
index 4ef8fb55f1..1b6d317c13 100644
--- a/esphome/components/web_server/web_server.h
+++ b/esphome/components/web_server/web_server.h
@@ -544,10 +544,9 @@ class WebServer : public Controller,
   template<typename T, typename Ret>
   void parse_string_param_(AsyncWebServerRequest *request, ParamNameType param_name, T &call,
                            Ret (T::*setter)(const std::string &)) {
-    // .c_str() is required for Arduino framework where arg() returns Arduino String instead of std::string
-    std::string value = request->arg(param_name).c_str();  // NOLINT(readability-redundant-string-cstr)
-    if (!value.empty()) {
-      (call.*setter)(value);
+    if (request->hasArg(param_name)) {
+      const auto &value = request->arg(param_name);
+      (call.*setter)(std::string(value.c_str(), value.length()));
     }
   }