Encoder / Decoder

Encode and decode text across Base64, Base64URL, URL percent-encoding, hexadecimal, and HTML entities. All processing runs in your browser — nothing is transmitted.

Encoder

Hex format:

Base64

—

Standard RFC 4648 — uses + / and = padding

Base64URL

—

URL-safe variant — uses - _ with no padding (JWTs, PKCE, etc.)

URL

—

Percent-encoding via encodeURIComponent — suitable for query params and form data

URL ×2

—

Double percent-encoding — useful for testing WAF/filter bypasses

Hex

—

Hexadecimal byte representation of the UTF-8 encoded string

HTML

—

Encodes < > & " ' / ` — safe for embedding in HTML contexts (OWASP recommended set)

Decoder

Decode as:

Decoded text will appear here.

Quick Reference

Base64 · RFC 4648 §4 Alphabet: A–Z a–z 0–9 + / padded with =

Base64URL · RFC 4648 §5 Replaces + → - and / → _ , no padding. Used in JWTs, PKCE, URL-safe data.

URL · RFC 3986 Percent-encodes all chars except A–Z a–z 0–9 - _ . ! ~ * ' ( )

URL ×2 · WAF bypass Encode % as %25 first. Some parsers double-decode, re-exposing the payload.

Hex · UTF-8 byte dump Each byte of the UTF-8 string shown as two hex digits.

HTML · OWASP XSS prevention Encode & < > " ' / ` to prevent injection into HTML/attribute contexts.