Encoders & Decoders
Encode and decode data in various formats — 4 free tools in our Developer Tools category.
All 4 tools
Base64 Encoder/Decoder
Encode and decode Base64 strings instantly. Free online Base64 converter tool for text and files. Works entirely in your browser.
URL Encoder/Decoder
Encode or decode URL strings. Converts special characters to percent-encoding and back. Free online URL encoder/decoder.
HTML Entity Encoder
Encode HTML special characters to entities or decode entities back to characters. Prevent XSS and display HTML safely.
JWT Decoder
Decode JWT tokens to see header and payload. Check expiration status. No data sent to server. Free online JWT decoder.
Encoding converts data into a form that survives a particular transport or context. It is not encryption: every encoding here is trivially reversible by anyone, and none of it protects anything. Choosing the right one comes down to asking which context is about to reject or mangle your characters.
Matching the encoding to the context
Base64 represents arbitrary binary data as printable ASCII. Use it to embed an image in CSS as a data URI, or to move a file through a text-only channel. Budget for the size: Base64 output is exactly one third larger than its input.
URL encoding escapes characters that carry structural meaning in a URL. The distinction that catches people out is between encoding a whole URL and encoding a single parameter value — the latter must also escape &, =, ? and /, or the value will break the URL around it.
HTML entities escape the five characters that are structural in markup: &, <, >, " and '. The ampersand has to be encoded first, or you double-encode the entities you just created.
The JWT Decoder is the odd one out. It reads the header and payload of a token, which are only Base64URL-encoded and therefore readable by anyone. Decoding is not verifying — checking the signature requires the issuer's key.
The security point worth repeating
Because all of this is reversible, none of it is a place to put a secret. A JWT payload is readable by whoever holds the token, so it should never contain passwords or card numbers. And escaping for HTML text is only correct for HTML text: attribute values, inline JavaScript, CSS and URLs each need their own rules.
Frequently Asked Questions
Is Base64 a form of encryption?▼
No. It is an encoding with no key and no secret, decodable by anyone in a single step. It is appropriate for transporting binary data through text channels and entirely inappropriate for protecting anything sensitive.
Why is a space sometimes %20 and sometimes a plus sign?▼
`%20` is correct in a URL path and always safe. A plus sign means a space only in form-encoded data, which is how HTML form submissions and query strings are traditionally encoded. Because of that ambiguity, a literal plus inside a value must be encoded as `%2B` or it will be read as a space.
Is it safe to paste a real JWT into a decoder?▼
Decoding happens in your browser and nothing is transmitted. Even so, treat an unexpired token as a live credential — anyone holding it can act as that user. Prefer expired or test tokens, and rotate the token afterwards if you decode a production one.