Encode & decode

What is Base64?

Base64 represents binary data using 64 printable characters (A–Z, a–z, 0–9, + and /). Every 3 bytes become 4 characters, so encoded data is about 33% larger. It’s used for email attachments, data URIs in HTML and CSS, and embedding binary data in JSON.

URL-safe Base64 swaps + and / for - and _ and often drops the = padding, so the result can sit in a URL or file name. JWTs use it.

Base64 is an encoding, not encryption: anyone can decode it.

When to URL-encode

URLs can only contain a limited set of characters. Spaces, accents and symbols like &, ? and # must be percent-encoded (a space becomes %20) when they appear inside a query value. “Component” mode encodes everything except letters, digits and -_.!~*'(), which is right for a single parameter value. “Full URL” mode leaves :/?#&= alone so a whole address stays usable.

Why escape HTML?

Characters like < and & have special meaning in HTML. Escaping them (<, &) makes a browser show them as text rather than markup — essential when displaying user input, and the first line of defence against cross-site scripting.

What’s inside a JWT

A JWT has three Base64URL parts separated by dots: a header (algorithm and type), a payload of claims (such as sub, exp and iat) and a signature. Decoding shows the header and payload; it does not verify the signature, which needs the issuer’s secret or public key.

Treat tokens like passwords. This decoder runs entirely in your browser, but avoid pasting production tokens into tools you don’t trust.