Encoders & Decoders
A free online encoder and decoder toolkit for Base64, URL percent-encoding, and JSON Web Tokens. Everything runs in your browser, so nothing you paste is ever uploaded.
Base64 Encode / Decode
Encode text to Base64 or decode it back, with full Unicode (UTF-8) and URL-safe support.
Open Base64 →URL Encode / Decode
Percent-encode text for safe use in URLs, or decode an encoded URL back to plain text.
Open URL →JWT Decoder
Decode a JSON Web Token to inspect its header, payload and expiry — entirely in your browser.
Open JWT →What these encoders and decoders do
This category groups three everyday transformations that move data safely between systems: Base64, URL encoding, and JWT decoding. They all share one idea — taking data in one representation and reversibly rewriting it into another that is easier or safer to transport. Each tool runs entirely in your browser, so the text or token you paste never leaves your device.
- Base64 Encode / Decode — turn arbitrary bytes into plain ASCII text and back, with full Unicode (UTF-8) and URL-safe variants.
- URL Encode / Decode — apply percent-encoding so text is safe inside a URL, for a single component or a whole URL.
- JWT Decoder — split a JSON Web Token and read its header, payload, and expiry without sending it anywhere.
Encoding is not encryption
This is the single most important thing to understand before using an online encoder decoder. Encoding is reversible and not secret. Base64 and URL encoding use public, well-known algorithms — anyone who sees the output can decode it right back to the original with no key or password. They exist to make data safe to transport, not to hide it.
Encryption is different: it uses a secret key so that only someone with that key can recover the original. None of the tools in this category provide confidentiality. If you need to protect a secret, encode is the wrong word — you want encryption (for example AES or TLS in transit), and you should never paste a real production secret into any web tool to "hide" it.
When to reach for each tool
Base64 is for carrying bytes through channels that only handle text — embedding a small image as a data URI, putting binary in JSON or an email, or storing a token in a cookie. It makes data about 33% larger, so it is a transport format, not a compression format. The URL-safe variant swaps + and / for - and _ and drops padding, which is exactly what JWTs use.
URL percent-encoding replaces characters that have special meaning in a URL — like a space, &, ?, or # — with % followed by their byte value, so a space becomes %20. Use Component scope to encode a single query value (it encodes &, =, and /), and Full URL scope to encode a whole address while leaving the structural characters intact.
JWT decoding lets you read what is inside a token. A JWT looks like header.payload.signature — three Base64URL segments joined by dots. Decoding shows you the algorithm, the claims, and when the token was issued and expires. Crucially, decoding does not verify the signature: it only reads the contents. Verifying authenticity requires the issuer's secret or public key, which never belongs in a client-side tool, so treat decoded claims as untrusted until your server validates the signature.
Guides
Learn the concepts behind these tools:
Encoders & Decoders FAQ
What is the difference between encoding and encryption?
Encoding rewrites data into another format using a public, reversible algorithm — anyone can decode it back with no key. Encryption scrambles data with a secret key so only someone holding that key can read it. Base64, URL encoding, and JWT decoding are all encoding, so they provide no confidentiality. Use them to make data safe to transport, never to hide a secret. If you need privacy, use real encryption (such as AES or HTTPS/TLS), and never paste a live secret into a web tool to "protect" it.
Is this online encoder decoder safe to use with sensitive data?
The tools themselves run 100% in your browser — the text, URL, or token you paste is never uploaded to a server, so there is no transmission risk from Formatly. That said, remember encoding is not secrecy: a decoded JWT payload or Base64 string is fully readable by anyone who has it. For genuinely sensitive production secrets, decode them in a trusted local environment and rely on signature verification and encryption rather than treating encoded text as protected.
Why use Base64 if it doesn't hide anything?
Base64 solves a transport problem, not a privacy one. Many channels — JSON, email headers, cookies, data URIs — only handle text reliably, so raw binary bytes can get corrupted. Base64 maps every 3 bytes onto 4 ASCII characters that survive those channels intact. It is the standard way to embed a small image inline, carry binary inside a text field, or pass a token in a URL. Just expect the output to be about 33% larger than the input, and never use it as a substitute for encryption.
Does decoding a JWT verify that it's valid?
No. Decoding only reads the contents — it splits the header.payload.signature segments, Base64URL-decodes them, and shows the claims and expiry. It does not check the signature, so a decoded token could be expired, tampered with, or forged. Verifying authenticity requires the issuer's secret or public key to validate the signature, which is a server-side step and never belongs in a client-side tool. Treat decoded claims as untrusted until your backend confirms the signature.
What is the difference between Component and Full URL encoding?
Component scope encodes a single piece of a URL — like one query-string value — and percent-encodes the structural characters &, =, ?, /, and # so they can't break the URL. Full URL scope encodes an entire address but deliberately leaves those structural characters alone so the URL still works. Rule of thumb: use Component when inserting a value into a URL, and Full URL when cleaning up a whole link that contains spaces or other unsafe characters.
Why is my Base64 still readable after encoding?
Because Base64 is encoding, not encryption — it is supposed to be readable and reversible. Anyone can paste the output into a decoder and recover your original text instantly, since the algorithm is public and needs no key. This is by design: Base64 exists to make bytes safe to move through text-only channels, not to conceal them. If your goal is to keep data secret, you need encryption with a key, not encoding.