Encode and decode data locally

Encodings move data through channels that would otherwise mangle it: Base64 packs bytes into ASCII, percent-encoding makes text safe inside URLs, HTML entities keep literal angle brackets out of markup, the HTML formatter pretty-prints or minifies templates without executing them, hex spells out raw bytes, query strings carry key-value pairs, and a JWT wraps JSON claims in Base64URL. These seven tools encode and decode all of them, in both directions.

Encoded data is often sensitive (auth headers, tokens, callback URLs), which is exactly why these run client-side. A JWT pasted into the decoder is decoded with JavaScript in this tab; it never crosses the network, which you can verify in your browser's dev tools.

All 7 encoding tools

JWT DecoderInspect header and payload of a JSON Web Token locally.Base64 Encode / Decode: Text, Images & FilesText, images, PDFs and any file to Base64 and back (Base64URL, data URLs and hex) without uploading.URL Encode / DecodePercent-encode query strings, paths and fragments.HTML Entity Encode / DecodeEscape text for HTML and decode entities back to text.Query String ↔ JSONTurn URL query strings into JSON and back.Hex Encode / DecodeConvert text and bytes to hexadecimal and back.HTML Formatter & BeautifierPretty-print or minify HTML in your browser without executing it.

Jump straight to a job

Guides

How to decode a JWT (and why that isn't verifying it)Split the token on its two dots and Base64URL-decode the first two segments, no key needed. Decoding shows the claims but never verifies anything.
Base64 vs Base64URLBase64 vs Base64URL differs by two characters (+/ vs -_) and = padding. Why JWT segments fail atob(), and how to convert locally in your browser.
SHA-256 vs SHA-1 vs MD5: which hash should you use?Use SHA-256 for anything that matters, SHA-1 and MD5 are collision-broken and fit only legacy checksums. What broken means and when it bites you.
Unix timestamps: seconds vs millisecondsCount the digits: 10 means seconds, 13 means milliseconds. Mixing them lands in January 1970 or the year 56637, two bug signatures explained.
How to fix “XML parsing error: not well-formed”Not well-formed means a syntax break: mismatched tags, a raw ampersand, two roots or a BOM. Find the first error's line and column locally.
What is a JWT? Structure, claims and how to decode one safelyA JWT is three Base64URL segments: header, payload and signature. Anyone can read the claims. Decode locally; never treat decode as verification.
What is Base64 encoding?Base64 turns every three bytes into four ASCII characters (RFC 4648). It is encoding, not encryption. Encode or decode in your browser; nothing is uploaded.

Looking for something else? Browse the full tool directory or read how the local-only processing works.