Encoder / decoder
Paste a strange string. It guesses what it is and decodes it. Or type plain text and see it in every encoding at once.
Runs in your browser. Nothing you paste or drop here is uploaded anywhere.
- Input
- Text
Base64 is a costume, not a lock. And ₪ is not &.
Decoded from Base64.
Inspect characters
| Char | Code point | Kind | UTF-8 | UTF-16 |
|---|
How to use it
- Paste the strange string into the box. In Auto mode the tool guesses the format, decodes it, and keeps going if the result is still encoded.
- Check the badge above the result. If the guess is wrong, pick one of the Or read it as options, or switch to Decode and choose the format yourself.
- To encode, switch to Encode and leave the format on All. Your text shows up as Base64, URL, hex, entities and the rest at once.
- Copy the result, or press Use as input to flip it back and check the round trip.
- Open Inspect characters to see code points and bytes. That is where invisible characters and lookalike letters get caught.
What it does
A Base64 decoder, URL decoder, HTML entity decoder and hex/Unicode converter in one box. Everything goes through UTF-8, so Hebrew, Cyrillic and emoji survive the trip: ₪ is three bytes, e2 82 aa, and 😀 is four.
Auto-detect scores each format by how the input looks and whether it decodes to readable text. SGVsbG8%3D is Base64 inside URL encoding, so it decodes twice and shows both steps. Short strings are ambiguous: cafe is a word and also valid hex, so the tool doesn’t guess there. Pick the format yourself.
When the bytes aren’t valid UTF-8 you get a hex dump and a note instead of a screen of �. Old systems still send Windows-1251 and Windows-1255; switch the byte view to read them. I met one of those in a bank integration that codes like it’s 1975.
JWTs are decoded, not verified: you see the header and payload, and the signature is only shown. HTML entities cover the HTML 4 set plus the common HTML5 names. The full list has over 2,000, and most of them never show up in the wild.
Questions
Is Base64 encryption?
No. Base64 is an encoding: anyone can decode it, no key needed. It exists to move bytes through places that only accept text, like JSON, email or URLs. Livewire, for example, sends component state as Base64, which is why you validate it on the server like any other user input.
Why does my Base64 decode to gibberish?
Usually because it isn’t text. Images, gzip, PDFs and encrypted data are all just bytes, and the tool says so when it recognises the file type. Other causes: the string was cut off or picked up extra characters when copied, it is Base64URL (- and _) that another tool read as standard Base64, or the text inside was in an old encoding like Windows-1255.
What’s the difference between encodeURI and encodeURIComponent?
encodeURI encodes a whole URL and leaves : / ? # & = alone; encodeURIComponent encodes one piece, like a query value, and escapes those too. Use the component version for anything you put inside a URL. The URL format here is encodeURIComponent; URL form also turns spaces into +, the way HTML forms send them.
Why does my site show ₪ instead of &?
That’s a font problem, not an encoding one. If the bytes are right (& is 26, ₪ is e2 82 aa) but the wrong glyph shows up, a web font is drawing it. Check with Inspect characters, then read how I fixed exactly this.
What is Base64URL?
Base64 with two characters swapped so the result is safe in URLs and file names: - instead of + and _ instead of /, usually without the = padding at the end. JWTs, many API tokens and WebAuthn use it. A strict Base64 decoder chokes on it; this one reads both, and the badge above the result says which one it saw.