Escaping turns the five characters HTML treats specially into entities: & becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. That stops user text from being read as markup. Decoding understands named entities like é and numeric ones like €.
How to use
- Pick a format: Base64, Base32, Hex, Binary, URL, HTML, Unicode or Punycode.
- Choose Encode or Decode, then type or paste. The output updates as you type.
- Tap the output to copy it, or download it. The swap button moves the output into the input and flips the direction.
- For Base64, drop any file to get raw Base64 or a data URL. Decoding Base64 of an image shows a preview you can download.
- If the input can’t be decoded, the error names the exact character and position.
- Everything is UTF-8: emoji, accents and any script round-trip correctly.
- Base64 decoding accepts standard and URL-safe alphabets, missing padding, line breaks and data: URLs.
- URL component mode encodes every reserved character (/ ? & = #); Full URI keeps the URL structure intact. Use “+ for space” for HTML form data.
- Punycode converts internationalized domain names: münchen.de ⇄ xn--mnchen-3ya.de. Paste a full URL and only the host is converted.
- Nothing is uploaded: encoding and decoding happen in your browser.
Encoding is not encryption
Every format here is a reversible way of writing bytes as text, defined by public standards: Base64 and Base32 by RFC 4648, percent-encoding by RFC 3986, entities by the HTML standard and Punycode by RFC 3492. Anyone can decode them without a key. Use them to move data through systems that only accept certain characters, never to hide secrets.
How Base64 works
Base64 takes 3 bytes (24 bits) at a time and writes them as 4 characters from A–Z, a–z, 0–9, + and /. Output is therefore about 33% larger than the input, and = pads the last group: Man becomes TWFu, Hello becomes SGVsbG8=. The URL-safe variant swaps + and / for - and _ so the result can sit in URLs and file names, which is what JWTs use.
Text is first turned into UTF-8 bytes, so é (2 bytes, c3 a9) and € (3 bytes, e2 82 ac) encode correctly. Tools that skip this step break on non-ASCII text.
Choosing the right format
Use URL encoding for query string values (a space becomes %20, or + in HTML form data), HTML entities when inserting user text into a page, hex or binary to inspect raw bytes, Base32 for case-insensitive codes such as TOTP secrets, and Punycode for internationalized domain names: münchen.de is xn--mnchen-3ya.de in DNS.
Frequently asked questions
Is Base64 encryption?
No. Base64 is an encoding that anyone can reverse instantly, without a key. It only makes binary data safe to send as text. Encrypt data first if it must stay private.
Why does Base64 make data bigger?
Every 3 input bytes become 4 output characters, so the size grows by about 33%, plus up to two = padding characters. A 30 KB image becomes about 40 KB of Base64.
What is the difference between URL component and full URI encoding?
Component mode encodes reserved characters such as / ? & = # so a value can sit inside a query string. Full URI mode leaves them alone so a whole address keeps working.
Why do I see %20 in some URLs and + in others?
Both stand for a space. %20 is standard percent-encoding (RFC 3986); + is used only in application/x-www-form-urlencoded form data. Use the + for space option when you build form-style query strings.
Can I decode Base64 to an image or file?
Yes. Paste Base64 or a data: URL in Decode mode; if it is an image you get a preview, and any file can be downloaded with its original bytes.
Does it handle emoji and non-Latin text?
Yes. Input is converted to UTF-8 before encoding and back after decoding, so emoji, accents, Cyrillic, Japanese and Korean text come back exactly as typed.