/
Encoding

4 Free Online Encoding & Decoding Tools

Encoding bugs all look the same from the outside: the data is right, but something in the pipeline mangled it. These 4 tools let you decode a value by hand and see what you actually have. Base64 Encode / Decode handles the transport format used by data URIs, email attachments, and Basic auth headers. URL Encode / Decode covers percent-encoding, the reason a query parameter with a space or an ampersand arrives truncated. HTML Entity Encode / Decode escapes the characters that would otherwise close a tag early or open an XSS hole. JWT Decoder splits a token into its header, payload, and signature so you can read the claims and the expiry without trusting a third-party site with a live credential. All four run entirely in your browser, which matters most for the tokens.

All 4 Encoding tools

What you can do with these encoding tools

Each tool works in both directions, so the same page answers "what does this decode to?" and "how do I encode this safely?".

  • Base64 — encode text or a file to Base64 for a data URI or an API field, and decode a Base64 blob back to readable text.
  • URL encoding — percent-encode a value before putting it in a query string, or decode a URL that arrived full of %20 and %2F.
  • HTML entities — escape <, >, &, and quotes before injecting text into markup, or decode entities pasted out of a rendered page.
  • JWT — decode a JSON Web Token to read its claims, algorithm, issued-at, and expiry without sending the token anywhere.

Encoding is not encryption

This is the single most common misunderstanding, and it is worth stating plainly: Base64 and percent-encoding are reversible transformations that anyone can undo in one step. They exist so that arbitrary bytes survive a channel that only accepts certain characters — they add no secrecy at all. The same applies to the payload of a JWT: it is Base64url-encoded, not encrypted, so treat everything inside it as public and never put a secret in a claim. If you need actual confidentiality or integrity, use the security tools instead — a hash, an HMAC signature, or an RSA key pair.

Related categories

Frequently asked questions

6

No. Base64 is a reversible encoding that anyone can decode instantly with no key — it exists to move binary data through text-only channels. Use hashing or encryption if you need the value to stay secret.

Yes. The JWT Decoder runs entirely in your browser and never transmits the token, so pasting a live access token does not expose it to a server. The token payload itself is only encoded, not encrypted, so anyone holding it can read the claims.

Whenever a value goes into a URL and could contain a space, an ampersand, a slash, a question mark, or a non-ASCII character. Without percent-encoding, those characters change the structure of the URL rather than travelling as data.

HTML entity encoding protects markup — it turns < into &lt; so the browser renders text instead of a tag. URL encoding protects addresses — it turns a space into %20 so the character survives the query string. They are not interchangeable.

Yes. The Base64 tool accepts a file and returns its Base64 representation, which is what you need for a data URI. For images specifically, Image to Base64 also emits ready-to-paste CSS and img snippets.

Yes, all 4 are free with no limits and no sign-up. They also keep working offline once the page has loaded, since the encoding happens locally.