Encode and decode Base64, URLs, HTML entities, Unicode, JWTs and classical ciphers. Encoding makes data safe to transport; it is not encryption and it is not hashing — anything encoded here can be decoded by anyone. Everything runs locally in your browser.
Your favourites
Recently used
Start from what you are trying to do
- Inspect a JSON Web TokenA readable view of a token's header and payload, and confidence that its structure is valid.3 steps, starting with JWT Decoder
- Build a token for testingA token you have assembled yourself and then read back to confirm it says what you meant.2 steps, starting with JWT Encoder
- Read a long URLThe parameters out of a percent-encoded URL, laid out so you can read them.3 steps, starting with URL Decoder
- Build a URL with parametersA query string whose values are encoded correctly, including the awkward characters.2 steps, starting with URI Component Encoder
- Work out why text has turned to gibberishAn explanation of which encoding a string is really in, and what its characters actually are.3 steps, starting with Character Encoding Detector
- Work out what an encoded string isA readable value, and a name for the encoding it was in.4 steps, starting with Base64 Decoder
- Embed a small file in CSS or HTMLA Base64 payload you can paste inline, and a check that it survived the round trip.3 steps, starting with Base64 Encoder
- Break or check a simple cipherPlaintext from a classical cipher, or confirmation of which one was used.4 steps, starting with ROT13 Encoder and Decoder
Encoding and Decoding
- Base64 EncoderConvert text or Unicode characters into Base64 – the binary-to-text encoding used by email attachments, data URIs and HTTP basic authentication.
- Base64 DecoderDecode a Base64 string back to readable text, with clear errors for invalid characters, wrong length and bad padding.
- Base64URL EncoderEncode text with the URL-safe Base64 alphabet from RFC 4648 section 5: minus and underscore replace plus and slash, and padding is normally dropped, so the result is safe in URLs, filenames and JWTs.
- Base64URL DecoderDecode URL-safe Base64 – the variant used in JWT header and payload sections – back to text, handling missing padding automatically.
- Base32 EncoderEncode data as Base32 (RFC 4648) using the case-insensitive A-Z 2-7 alphabet found in TOTP authenticator secrets, DNS records and Onion addresses.
- Base32 DecoderDecode Base32 back to text or bytes.
- Base58 EncoderEncode bytes as Base58 – the Bitcoin alphabet that deliberately omits 0, O, I and l so codes survive being read aloud, handwritten or retyped.
- Base58 DecoderDecode a Base58 string such as a Bitcoin address or IPFS CIDv0 back to its underlying bytes, shown as text where possible and hex otherwise.
- Ascii85 EncoderEncode data as Ascii85 (base85), which packs 4 bytes into 5 characters for about 25 percent overhead versus the 33 percent of Base64.
- Ascii85 DecoderDecode Ascii85 or base85 data back to bytes, accepting the Adobe delimiters and the z shortcut that stands for four zero bytes.
- URL EncoderPercent-encode a URL or a single value.
- URL DecoderDecode percent-encoded URLs back to readable text, with an optional plus-as-space rule and a repeat mode that unwraps double-encoded values such as %253A.
- URI Component EncoderEscape a single URI component – a query value, path segment or fragment – so reserved characters like ampersand, equals, question mark, slash and hash cannot break the surrounding URL.
- URI Component DecoderDecode a single percent-encoded URI component back to its original value, treating the plus sign as a space by default as HTML form submissions do.
- Query String ParserSplit a URL query string into readable key and value pairs or JSON, decoding percent-escapes and plus signs, and flagging repeated parameters whose handling differs between servers.
- Query String BuilderTurn key and value lines or a JSON object into a correctly escaped query string, with repeated keys for array values and optional RFC 3986 strict escaping.
- HTML Entity EncoderConvert characters into HTML entities so markup displays as text instead of being parsed.
- HTML Entity DecoderTurn HTML entities back into characters – named, decimal and hexadecimal – with a repeat mode for text that was escaped twice.
- XML Entity EncoderEscape text for XML, which predefines only amp, lt, gt, quot and apos – everything else must be a numeric reference.
- XML Entity DecoderDecode XML entities back to text.
- Punycode EncoderConvert an internationalized domain name to its ASCII xn-- form using RFC 3492 Punycode, so non-Latin domains work in DNS.
- Punycode DecoderTurn xn-- domain labels back into readable Unicode, and flag mixed-script labels that may be homograph lookalike domains used in phishing.
- Text to BinaryConvert text into binary – eight bits per UTF-8 byte, or one number per Unicode code point.
- Binary to TextConvert binary numbers back into readable text.
- Text to HexConvert text to hexadecimal – two hex digits per UTF-8 byte, or per code point.
- Hex to TextConvert hexadecimal back to text, accepting spaces, commas, colons and 0x prefixes, and warning when the bytes decode to something other than clean UTF-8.
- Text to ASCIIConvert text to ASCII character codes in decimal, hex, binary or octal, with strict validation because ASCII defines only the 128 characters numbered 0 to 127.
- ASCII to TextTurn ASCII character codes back into text, with an option to name control characters such as LF and TAB instead of printing invisible bytes.
- Text to DecimalConvert text into decimal numbers – full Unicode code points by default, so an emoji becomes a single number such as 128512 rather than several byte fragments.
- Decimal to TextConvert decimal numbers back into characters, treating them as Unicode code points or as raw UTF-8 bytes, with clear errors for surrogates and out-of-range values.
- Text to OctalConvert text into octal, base 8, at three digits per byte.
- Octal to TextConvert octal numbers back into readable text, validating that every digit falls in the range 0 to 7.
- Unicode EscapeTurn characters into escape sequences for JavaScript, ES6, CSS, Python, Java or C, which is useful when source files or config formats must stay pure ASCII.
- Unicode UnescapeConvert escape sequences in the JavaScript, ES6, Python and hex styles back into the characters they represent, flagging unpaired surrogates.
- Unicode Code Point ConverterLook up the code point of every character – with its decimal value, UTF-8 bytes and UTF-16 units – or turn U+ notation back into text.
- UTF-8 Encoder and DecoderInspect exactly how text becomes UTF-8 bytes – as hex, percent-escapes, decimal or hex escapes – and convert those bytes back to text.
- UTF-8 Byte CounterCount UTF-8 bytes, characters and UTF-16 units separately – the three numbers that disagree whenever emoji or non-Latin scripts appear – and compare them against common limits.
- Character Encoding DetectorAnalyse bytes for a byte order mark, ASCII-only content, valid UTF-8 and classic mojibake patterns, separating what can be proven from what can only be guessed.
Ciphers and Tokens
- ROT13 Encoder and DecoderApply ROT13, ROT13.5 or ROT47 – letter rotations used to hide spoilers and puzzle answers from casual reading.
- Caesar Cipher Encoder and DecoderShift letters by any amount from 1 to 25, or break an unknown Caesar cipher instantly by showing all 25 possible shifts at once.
- Atbash CipherApply the Atbash substitution, which mirrors the alphabet so A becomes Z and B becomes Y.
- Vigenere Cipher Encoder and DecoderEncrypt or decrypt with a repeating keyword, the classic polyalphabetic cipher.
- Morse Code TranslatorTranslate text to international Morse code and back, covering letters, digits and common punctuation, with configurable word separators.
- NATO Phonetic Alphabet ConverterSpell text out in the ICAO and NATO phonetic alphabet – Alfa, Bravo, Charlie – for reading codes aloud over phone or radio, and convert phonetic words back to text.
- Quoted-Printable EncoderEncode text as quoted-printable (RFC 2045), the email transfer encoding that keeps mostly-ASCII text readable while escaping everything else.
- Quoted-Printable DecoderDecode a quoted-printable email body back to readable text, resolving the escapes and removing soft line breaks.
- MIME Header Encoder and DecoderDecode encoded words from email Subject and From headers, or build your own – the RFC 2047 mechanism that lets ASCII-only headers carry any language.
- JWT DecoderDecode a JSON Web Token to inspect its header and payload, with registered claims explained and timestamps converted to dates.
- JWT Structure ValidatorCheck a JWT for structural problems – section count, Base64URL validity, JSON shape, the required alg field, claim types, expiry and the dangerous alg none case.
- JWT EncoderBuild and sign a demonstration JWT locally with HS256, HS384 or HS512.
No tools match thatTry a shorter word, or a different spelling.
Frequently asked questions
What is the difference between encoding and encryption?
Encoding rearranges data into a safe alphabet and is reversible by anyone, with no key involved. Encryption protects data with a key. Base64 is encoding, so Base64 protects nothing — treating it as a security measure is a common and serious mistake.
When do I need Base64?
When binary data has to travel through something that only accepts text: an email attachment, a JSON field, a data URI, an HTTP header. It costs about a third more size, which is the price of that safety.
What is the difference between Base64 and Base64URL?
The alphabet. Base64 uses + and /, both of which have meaning in a URL, so Base64URL substitutes – and _ and usually drops the padding. Using plain Base64 in a query string is why tokens sometimes arrive corrupted.
When should I use percent-encoding instead?
For text going into a URL. Percent-encoding keeps readable characters readable and escapes only what would otherwise be structural, so a URL stays legible. Base64 makes everything opaque, which is right for binary and wrong for a path.
Does encoding handle emoji and non-Latin scripts?
Yes. Text is converted to UTF-8 bytes before any encoding is applied, so accents, Arabic, Chinese and emoji all survive a round trip. Emoji are the useful test case because they sit outside the Basic Multilingual Plane and break naive code.
Why does my decoded text come out as gibberish?
Almost always a character-set mismatch: the bytes were decoded as Latin-1 when they were UTF-8, or the string was truncated so the final group is incomplete. The decoders report which of the two happened rather than returning mojibake silently.
Is what I paste uploaded?
No. Encoding and decoding happen in your browser, which matters because the strings people decode are so often tokens, headers and payloads that should not be pasted into someone else's service.
