Encode and decode data locally
Encodings move data through channels that would otherwise mangle it: Base64 packs bytes into ASCII, percent-encoding makes text safe inside URLs, HTML entities keep literal angle brackets out of markup, hex spells out raw bytes, query strings carry key-value pairs, and a JWT wraps JSON claims in Base64URL. These six tools encode and decode all of them, in both directions.
Encoded data is often sensitive — auth headers, tokens, callback URLs — which is exactly why these run client-side. A JWT pasted into the decoder is decoded with JavaScript in this tab; it never crosses the network, which you can verify in your browser's dev tools.
All 6 encoding tools
JWT DecoderInspect header and payload of a JSON Web Token locally.Base64 Encode / DecodeConvert text to Base64 and back without uploading.URL Encode / DecodePercent-encode query strings, paths and fragments.HTML Entity Encode / DecodeEscape text for HTML and decode entities back to text.Query String ↔ JSONTurn URL query strings into JSON and back.Hex Encode / DecodeConvert text and bytes to hexadecimal and back.
Jump straight to a job
Guides
- How to decode a JWT (and why that isn't verifying it)Split the token on its two dots and Base64URL-decode the first two segments — no key needed. Decoding shows the claims but never verifies anything.
- Base64 vs Base64URL: what's the difference?Base64URL swaps + and / for - and _ and drops = padding so tokens survive URLs. That is why JWT segments fail standard decoders, and how to convert.
- SHA-256 vs SHA-1 vs MD5: which hash should you use?Use SHA-256 for anything that matters — SHA-1 and MD5 are collision-broken and fit only legacy checksums. What broken means and when it bites you.
- Unix timestamps: seconds vs millisecondsCount the digits: 10 means seconds, 13 means milliseconds. Mixing them lands in January 1970 or the year 56637 — two bug signatures explained.
Looking for something else? Browse thefull tool directoryor readhow the local-only processing works.