Encoding Tools
Tools for encoding and decoding data — Base64, URL encoding, and number bases such as binary and hex — all running entirely in your browser.
Quick tasks
One click opens the tool already set up for the job.
Online Encoding Tools - Base64 and URL Encoding in Your Browser
Encoding is not encryption. It hides nothing and protects nothing. Its job is to take data that would break something - a channel that only carries text, a URL that treats & as a separator, an email header that predates Unicode - and reshape it into characters that survive the trip. The tools in this category do that in both directions, entirely inside your browser.
This distinction is worth being blunt about, because it is the single most common misunderstanding in the area. Base64 is reversible by anyone, instantly, with no key. A password stored as Base64 is a password stored in plaintext with an extra step. If you need secrecy you need cryptography, not encoding.
What is in this category
| Tool | What it does | Reach for it when |
|---|---|---|
| Base64 Encoder | Converts text and files to Base64 and back, including URL-safe output | Embedding an image in CSS, reading an API key, or moving binary data through a text-only field |
| URL Encoder | Percent-encodes and decodes URLs and query-string values | A link breaks at the first space, ampersand or non-Latin character |
| Number Base Converter | Converts between binary, octal, decimal, hex and any base up to 36, and turns text into bytes and back | A value in a hex dump, a bit mask or a permission needs reading as a number |
| HTML Entity Encoder | Escapes text for HTML with named or numeric entities, and decodes any entity back to text | A code sample, a user comment or an export shows < or & where it should show < or & |
What Base64 actually does
Base64 takes three bytes at a time - 24 bits - and rewrites them as four characters drawn from a 64-character alphabet: A-Z, a-z, 0-9, plus + and /. Because 64 is 2 to the sixth, each output character carries exactly six bits. When the input does not divide evenly into three, the output is padded with = so the length is always a multiple of four.
The consequence is arithmetic, not opinion: Base64 output is about 33% larger than the input. Encoding a 300 KB image to embed in a stylesheet produces roughly 400 KB of text. That is a real cost and the reason inlining is worth it for small icons and rarely worth it for photographs.
The + and / characters are a problem inside URLs, where they already mean something. URL-safe Base64 replaces them with - and _ and usually drops the padding. This is the variant used by JSON Web Tokens, and mixing the two up is why a token sometimes fails to decode in one tool and works in another.
What percent-encoding actually does
A URL has a grammar. ? starts the query string, & separates parameters, = joins a name to a value, # starts the fragment, and space is not allowed at all. When a value contains one of those characters, it has to be escaped or the URL means something other than what you intended. Percent-encoding replaces the character with % followed by its byte value in hexadecimal: space becomes %20, & becomes %26, / becomes %2F.
Non-ASCII text is encoded as its UTF-8 bytes, one %XX per byte. A single Persian or Japanese character usually becomes three escapes. This is why a URL containing a search term in a non-Latin script looks so much longer than the term itself.
The trap is knowing which part of the URL you are encoding. Encoding a whole URL turns its :// and / into escapes and destroys it. You almost always want to encode one parameter value, then assemble the URL around it. The URL encoder handles both, but the choice is yours to make.
Number bases: the encoding under all the others
Base64 and percent-encoding both work on bytes, and bytes are usually written in hexadecimal or binary. The number base converter reads a value in any base and shows it in the others at once, with no 64-bit limit, and its Text tab shows the UTF-8 bytes behind a string. That is the quickest way to see why é takes two bytes, why %C3%A9 is its percent-encoded form, and why 0xFF is 255.
Where you will meet these encodings
- Data URIs -
data:image/png;base64,...embeds an image directly in HTML or CSS and saves a request. - HTTP Basic auth - the header is literally
Basicfollowed by Base64 ofuser:password. Reversible by anyone who sees it, which is why it belongs only inside TLS. - JSON Web Tokens - three URL-safe Base64 segments joined by dots. The payload is readable without any key.
- Email attachments - MIME has carried binary as Base64 since the early 1990s, and still does.
- Query strings - any search term, redirect target or filter value with a space or symbol in it.
- Config and secrets files - Kubernetes secrets, service-account keys and certificates are routinely stored Base64-encoded.
Common failures and what causes them
- Double encoding. A value gets encoded by your code and again by a framework, so
%20becomes%2520. If you see%25in a URL, something encoded a percent sign that was already an escape. - Wrong Base64 alphabet. A JWT that will not decode is usually URL-safe Base64 being fed to a standard decoder, or the reverse.
- Missing padding. Some producers drop the trailing
=. Strict decoders reject the result; lenient ones restore it. - Encoding the whole URL. The scheme and path get escaped and the link stops resolving.
- Assuming it is secure. Base64 in a cookie, a header or a config file is readable by anyone who can read the file.
- Plus signs in query strings. In form-encoded data
+means space; in a path it means a literal plus. The same character, two meanings.
Why it matters that this runs locally
The strings people need to encode and decode are disproportionately sensitive: authorization headers, session tokens, service-account keys, signed URLs. Pasting one of those into a website that processes it server-side hands over a live credential to a third party. Both tools here run in the browser - the input never leaves the tab, and you can verify that in your network panel.
Related categories
- Text tools - format and validate the JSON that so often sits inside an encoded payload.
- Developer tools - decode a JWT properly rather than Base64ing its parts by hand, or hash a value when you need a fingerprint rather than a reversible form.
- Generator tools - produce the identifiers and secrets that later end up encoded.