Base64 / URL / HTML Encoder-Decoder
Convert text to and from Base64, percent-encoding (URL) and HTML entities with correct Unicode handling.
Runs locally in your browser
Discuss a result
Write a short summary and review it before posting. Your tool inputs are never copied automatically.
What is the Base64 / URL / HTML Encoder-Decoder?
This tool encodes and decodes text using three common web schemes: Base64, URL percent-encoding and HTML entity encoding.
How to use it
- 1Pick a scheme.
- 2Choose encode or decode.
- 3Enter text and read the result.
How it works
Base64 uses a UTF-8 safe encode/decode path so emoji and accents survive. URL mode uses encodeURIComponent/decodeURIComponent. HTML mode escapes and unescapes the five core entities.
Limitations & notes
- Base64 is encoding, not encryption — it provides no confidentiality.
Frequently asked questions
When should I use Base64, URL encoding, HTML entities or hex?
Use URL encoding for values placed in a query string or path segment, HTML entities when showing user text inside a web page, Base64 for carrying binary or arbitrary text through text-only fields like JSON or email, and hex when you need to inspect the exact bytes of a string. Each solves a different escaping problem, and none of them hides data from anyone who can read it.
Which HTML entities does this tool encode and decode?
It handles the five characters that matter for safe HTML output: & becomes &, < becomes <, > becomes >, a double quote becomes " and a single quote becomes '. Other entities such as , © or numeric codes like © are left untouched when decoding. Accented letters and emoji are not converted to entities because modern UTF-8 pages can display them directly.
Does escaping HTML entities prevent XSS?
Escaping those five characters prevents injected text from creating new tags or breaking out of a quoted attribute, which blocks the most common cross-site scripting cases. It is not enough everywhere: values placed in a href, inside a script block, or in CSS need context-specific handling. For example, javascript:alert(1) contains none of the five characters and survives escaping unchanged, so URLs also need a scheme check.
What does the Hex UTF-8 option show?
It lists each UTF-8 byte of your text as two lowercase hex digits, so Hi becomes 4869 and é becomes c3a9. This is handy for spotting invisible characters such as a non-breaking space (c2a0) or a byte order mark (efbbbf). When decoding, spaces between pairs are ignored, but the input must contain an even number of hex digits that form valid UTF-8, otherwise decoding fails.
Why does the encoded box stay empty for some input?
Encoding returns nothing if the browser refuses the input. The usual cause in URL mode is a broken emoji or lone surrogate character left over from a bad copy and paste, which encodeURIComponent cannot encode. Retyping or re-copying the text normally fixes it. Decoding problems are reported separately in the decode panel, which shows a could not decode message instead of a partial result.
No directly related discussion yet.
Start a focused thread and share the question this tool helped you explore.
Ask the community about Base64 / URL / HTML Encoder-Decoder