Base64 / URL Encoder & Decoder
Transform UTF-8 text with Base64, URL, and HTML entity schemes.
Output
Transformed output appears here.
Base64 decoding accepts canonical standard or URL-safe input. Non-UTF-8 bytes are shown as a bounded hex dump.
Working notes
Use Base64 / URL Encoder & Decoder with the boundary visible.
Base64 / URL Encoder & Decoder transforms bounded text using Base64, URL percent-encoding, or HTML entities and distinguishes text decoding from binary bytes.
What is Base64 / URL Encoder & Decoder?
Encoding transforms data from one representation to another so it can be safely transported through systems that have character restrictions. Base64 encoding converts arbitrary binary data into a string of 64 printable ASCII characters (A-Z, a-z, 0-9, +, /), making it safe to embed in JSON, XML, email bodies, and data URIs. URL percent-encoding (also called URL encoding) replaces characters that have special meaning in URLs — such as spaces, ampersands, and question marks — with percent-encoded equivalents (%20, %26, %3F). HTML entity encoding converts reserved HTML characters (<, >, &, ") into named or numeric entities so they display as text instead of being interpreted as markup. None of these encodings provide any security or confidentiality — they are fully reversible transformations designed for transport compatibility. Base64 increases data size by roughly 33%, URL encoding expands only unsafe characters, and HTML entity encoding expands only reserved characters. Understanding which encoding to use and when is essential for building correct APIs, handling file uploads, and preventing XSS vulnerabilities in web applications.
When to use it
- Embedding images in CSS or HTML — Base64-encode a small icon or SVG to create a data URI, eliminating an extra HTTP request.
- Building API requests — URL-encode query parameters that contain special characters (spaces, ampersands, equals signs) so the server parses them correctly.
- Debugging webhook payloads — decode a Base64-encoded webhook body to read the original JSON or XML content.
- Preparing email content — Base64-encode attachments or HTML email bodies for MIME-encoded messages.
- Preventing XSS — HTML-entity-encode user-generated content before inserting it into a web page to neutralize script injection.
- Passing binary data through JSON — Base64-encode binary blobs (images, certificates, protobuf) since JSON has no binary type.
How to use it
- 01Choose the encoding mode: Base64, URL percent-encoding, or HTML entities.
- 02Select the direction: encode (text to encoded form) or decode (encoded form back to text).
- 03Enter the exact source text in the input field.
- 04Run the transform. The output shows the encoded or decoded result.
- 05For Base64 decoding of non-text binary data, review the hexadecimal preview to see the raw bytes.
Common mistakes
- Confusing encoding with encryption — Base64, URL encoding, and HTML entities are fully reversible by anyone. They provide zero confidentiality.
- Double-encoding URLs — encoding an already-encoded URL produces sequences like %2520 (percent-encoded percent sign). Always encode raw values, not already-encoded strings.
- Using standard Base64 in URLs — standard Base64 uses + and / which conflict with URL syntax. Use Base64url (- and _ instead) for tokens, filenames, and query parameters.
- Encoding entire URLs instead of components — only the values of query parameters and path segments should be percent-encoded, not the delimiters (?, &, =, /).
- Forgetting padding in Base64 — standard Base64 pads with = characters to make the output a multiple of 4. Some systems strip padding; others require it. Know which your system expects.
Synthetic example
Decode a Base64 word
Input
c3RhY2tjYWNoZQ==
Result
stackcache
Base64 vs URL encoding vs HTML entities
| Feature | Base64 | URL encoding | HTML entities |
|---|---|---|---|
| Input | Any binary data | Text for URLs | Text for HTML |
| Output charset | A-Z, a-z, 0-9, +, /, = | Printable ASCII + %XX | ASCII + &name; / &#NNN; |
| Size overhead | ~33% always | Only unsafe chars | Only reserved chars |
| Reversible | Yes | Yes | Yes |
| Common use | Data URIs, APIs, email | Query params, form data | HTML display, XSS prevention |
| Provides security | No | No | Prevents XSS only |
Related standards
Limits and data boundary
- Encoding does not encrypt or protect data.
- URL encoding a component is different from validating or safely constructing a complete URL.
Frequently asked questions
- What is Base64 encoding?
- Base64 encodes binary data as ASCII text using 64 printable characters. It is commonly used to embed images in CSS, encode email attachments, and pass binary data in JSON or URLs.
- Is Base64 the same as encryption?
- No. Base64 is a reversible encoding, not encryption. Anyone can decode a Base64 string. Use proper encryption for sensitive data.
- What is URL percent-encoding?
- URL encoding replaces unsafe characters with percent-encoded equivalents (e.g., space becomes %20) so that special characters can safely appear in URLs and query strings.
- When should I use Base64url instead of standard Base64?
- Use Base64url when the encoded string will appear in URLs, filenames, or cookies. It replaces + with - and / with _ to avoid conflicts with URL-reserved characters, and often omits trailing = padding.
- Why does my Base64 string end with equal signs?
- The = characters are padding. Base64 output must be a multiple of 4 characters. Padding fills the remaining slots when the input length is not a multiple of 3 bytes.
Keep working