Base64 & URL encoder/decoder.
Encode or decode Base64, Base64url and URL percent-encoding. Type in either box and the other updates. UTF-8 safe. Nothing leaves your browser.
About this tool
Pick a scheme, then type or paste into either side. Text is treated as UTF-8 in both directions, so emoji and non-Latin scripts round-trip correctly. Whitespace in Base64 input is ignored, which makes pasting wrapped output from openssl or email painless. Everything runs in the page.
The four schemes
| Scheme | What it is for |
|---|---|
| Base64 | Turns arbitrary bytes into a 64-character ASCII alphabet (A-Z a-z 0-9 + /) with = padding. Found in Authorization: Basic headers, data URIs, MIME email, PEM certificates and many config files. |
| Base64url | The same idea with - and _ instead of + and /, and no padding, so the value survives inside a URL or a cookie. Used by JWTs, WebAuthn and most OAuth flows. See Base64 vs Base64url. |
| URL (percent-encoding) | Escapes characters that are not allowed in a URL as %XX while leaving the URL's own structure (/, ?, &, =, #) alone. Use this on a whole URL. Equivalent to JavaScript's encodeURI. |
| URL component | Also escapes /, ?, &, = and #, so a value can be dropped into a query string without changing its meaning. Use this on a single parameter value. Equivalent to encodeURIComponent. |
Common encoding problems
- "Invalid character" decoding Base64: the input is Base64url (has
-or_), or has been URL-encoded on top (%3Dfor=). Switch scheme, or decode the URL layer first. - Wrong length: Base64 needs a multiple of four characters once padding is included. Missing
=usually means Base64url or a truncated copy. - Plus signs became spaces: a Base64 value went through a form submission unencoded. Use Base64url, or URL-component-encode it first.
- Mojibake (é instead of é): the bytes were UTF-8 but decoded as Latin-1 somewhere else. This tool always uses UTF-8.
- Double encoding:
%2520is a space that was percent-encoded twice. Decode until it stops changing. - Space as + or %20:
application/x-www-form-urlencodeduses+; everywhere else it is%20. Both decode here.
Uses
- Reading a
Basicauth header or a Kubernetes secret. - Decoding the segments of a JWT by hand.
- Building a query string parameter that contains slashes, ampersands or spaces.
- Working out what a percent-encoded redirect URL actually points to.
- Embedding a small image or file in a data URI.
From the command line
On macOS and Linux: echo -n 'text' | base64 and echo 'dGV4dA==' | base64 -d. For Base64url, pipe through tr '+/' '-_' | tr -d '='. URL-encode with curl --data-urlencode or python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=""))' 'a b/c'.