Skip to content
🔐

Encode & Decode

Base64, URL percent-encoding, HTML entities, hex, binary, JWT — all UTF-8 safe and runs entirely in your browser.

⭐

Essentials

start here
🔐 Base64 Encode 🔐 Base64 Decode 🔐 URL Encode 🔐 JWT Decoder 🔐 HTML Entity Encode 🔐 Hex to Text 🔐 JWT Generator 🔗 Slugify

Base64 & URL

7 tools
🔐 Base64 Encode 🔐 Base64 Decode 🖼️ Image to Base64 🔐 File to Base64 🔐 URL Encode 🔐 URL Decode 🔗 URL Parser

HTML entities

2 tools
🔐 HTML Entity Encode 🔐 HTML Entity Decode

Other encodings

4 tools
🔐 Hex to Text 🔐 Text to Hex 🔐 Binary to Text 🔐 Text to Binary

JWT

2 tools
🔐 JWT Decoder 🔐 JWT Generator

Slugify

1 tools
🔗 Slugify

Encoding is not encryption

Worth stating up front, because it's the most consequential misunderstanding in this category: everything here is encoding, not encryption. Base64, hex, URL percent-encoding, and HTML entities are all reversible by anyone, with no key and no secret. They exist to make data survive a transport channel safely — not to hide it.

A Base64 string is not a password-protected string. A JWT payload is readable by anyone holding the token. If you need confidentiality, you need actual encryption, and these tools are the wrong category.

Which encoding you want

  • Base64 — for moving binary data through channels that only handle text: embedding files in JSON, email attachments, data URLs. Costs about 33% size inflation.
  • URL encoding — for putting arbitrary values into a URL. Any query parameter carrying user input, a path, or another URL needs it, or the &, ?, and / characters will break the URL's structure.
  • HTML entities — for displaying text that contains <, >, or & as characters rather than markup. This is also the baseline defence against injecting markup into a page.
  • Hex and binary — for inspecting byte-level data: file headers, hashes, protocol dumps, colour values.
  • Slugify — for turning a title into a clean URL segment, stripping accents and punctuation and collapsing spaces to hyphens.

JWTs specifically

A JSON Web Token has three Base64url-encoded parts: header, payload, and signature. Decoding one shows you the claims — issuer, subject, expiry — which is what you usually want when debugging an auth problem: checking whether the token has expired, or which scopes it actually carries.

Decoding does not verify anything. Verification requires the signing key, and it's the server's job. Treat a decoded payload as a claim, not a fact.

UTF-8 and why encoders disagree

Most bugs in this area come from non-ASCII characters. An emoji, an accented letter, or a curly quote is multiple bytes in UTF-8, and encoders that assume one byte per character mangle them. The tools here handle UTF-8 correctly throughout, which is why decoding a string here may give a different — and correct — result from an older tool.

Nothing leaves your browser

Every tool here runs locally in JavaScript. That matters more in this category than most: tokens, keys, and payloads are exactly the kind of data you should never paste into a server-side tool. Nothing is uploaded or logged.

← Browse all 101 tools