Online Encoders & Decoders for Developers
Encode and decode Base64, URLs, HTML entities, certificates, QR codes, and more in your browser.
Choose a tool
Encoding is about representation, not secrecy.
Eight tools here move a value between representations: text to Base64, characters to percent-escapes or HTML entities, bytes to a Data URL or a QR image, and compressed bytes back to readable text. Three of them mostly inspect rather than convert. Nothing in this category adds confidentiality, because every operation is reversible by anyone holding the output. Choose by the destination that will parse the value, not by which output looks tidiest.
Three escaping tools that are not interchangeable
URL Encoder & Decoder, HTML Entity Encoder & Decoder, and Base64 Encoder & Decoder get confused constantly, because all three turn readable text into something less readable. Choose by destination: percent-encoding for a URL component, entities for text that will land inside HTML, Base64 for arbitrary bytes that must survive a text-only channel.
Encoding for the wrong context is how a value survives review and breaks in production. An ampersand percent-encoded inside an HTML attribute is still an unescaped ampersand to the HTML parser, and an entity inside a query string is just extra characters the server will never decode. When a value crosses two boundaries, encode once per boundary, in the order it travels.
Base64 for text, Base64 for images, and Gzip for the opposite problem
Base64 Encoder & Decoder is for strings: a header value, a token, a snippet that has to pass through a field that only accepts text. It offers the Base64URL alphabet, which is what you want whenever the receiver is a JWT or a URL. Base64 Image Encoder & Decoder is for bytes, reports the detected media type, and produces a Data URL you can paste into CSS or HTML.
Both make the payload about a third larger. A Data URL is a good fit for a small inline asset or a test fixture and a poor fit for a real image, since it cannot be cached separately. Gzip Compressor & Decompressor solves the reverse problem, and is also the tool for reading a response body that arrived compressed.
The tools that tell you what is already inside a value
Certificate Parser, JWT Decoder & Verifier, and QR Code Generator & Scanner all answer the same shape of question. The parser expands a PEM, DER, PFX, or PKCS#12 blob into subject, validity window, SAN list, and chain. The JWT tool splits header from claims. The scanner reads a code from an upload, a paste, or the camera.
Decoding a JWT and verifying it are deliberately separate acts. Anyone holding a token can read its claims, because the segments are Base64URL and not encryption, so a decoded payload only tells you what the issuer asserted. Whether to believe it is a signature check against the right key, plus the exp and aud claims.
Before you rely on a result
- Match the alphabet to the receiver: Base64URL without padding for tokens and URLs, standard Base64 elsewhere.
- Encode once per context boundary, in the order the value actually travels through them.
- Verify a JWT signature before trusting any claim in the decoded payload, and read exp and aud while you are there.
- Read a certificate's validity window and SAN list, not only its subject. Most certificate outages are an expired leaf or a hostname missing from the SANs.
- Treat everything you paste as visible. Encoding is reversible by definition, so redact real secrets before they reach any tool, including this one.
Frequently asked questions
Is Base64 a form of encryption?
No. Base64 is a way to represent bytes using a restricted character set, and reversing it requires no key at all. An encoded API key offers no protection whatsoever. Use TLS in transit and a secret manager at rest when confidentiality is the requirement.
Which tool do I use for a query string parameter?
URL Encoder & Decoder, applied to the individual component rather than the whole URL. Encoding a complete URI escapes the slashes and the question mark that give it structure, which is why the tool distinguishes component encoding from full-URI encoding.
Why does my JWT verify in one place and fail in another?
Almost always the algorithm or the key material. HS256 takes a shared secret while RS256 takes a public key, and some systems supply the HMAC secret Base64-decoded while others use the raw bytes of the string. Check the header alg against the key you pasted before suspecting the token.
Do certificates, tokens, and images leave my browser?
No. Every tool in this category runs locally in the tab and nothing is transmitted or stored between visits. That is a statement about the network, not about your screen: a private key or a live session token is still exposed to anything running in your browser.
Browse all developer tools or read the developer tool guides for worked examples.