Encode / decode
Base64, URL, and HTML entities — both directions, all local. Decoding a JWT?
Base64, URL, and HTML entities — both directions, all local. Decoding a JWT?
Base64 turns any text (UTF-8 aware — emoji and accents survive) into the
64-character alphabet used in data URIs, basic auth headers, and email attachments.
Base64url is the URL-safe variant used by JWTs.
URL applies percent-encoding: component mode for query values, full mode for
complete URLs. HTML escapes & < > " ' for safe embedding
in markup, and decoding handles named and numeric entities both.
Everything runs client-side in this page. Paste tokens, credentials, or internal URLs freely — no request carries them anywhere.
No. Base64 is a reversible text encoding — anyone can decode it instantly. It exists to move binary data through text-only channels, not to hide anything. If you need secrecy, you need actual encryption.
Base64url swaps + for -, / for _, and drops the trailing = padding, so the result is safe inside URLs and filenames. JWTs use base64url for all three segments.
Component encoding (encodeURIComponent) escapes everything reserved — use it for a single query-string value. Full URL encoding (encodeURI) keeps :/?#&= intact — use it when encoding a whole URL that must stay clickable.
No. Every conversion runs in your browser. Nothing is uploaded, logged, or stored — check the network tab while you type.