Encode and decode data between representations
Data often has to change shape to travel safely: URLs cannot contain spaces, binary data cannot go into a JSON string, and compressed payloads are unreadable until decompressed. These encode and decode tools convert text and data between common representations, and back again, so you can build requests, read tokens and debug what a system actually sent.
Which encoder do you need?
- URLs and query strings – URL encode and URL decode handle percent-encoding such as
%20for spaces; the URL parser splits a URL into its components. - HTML entities – HTML encode and HTML decode convert characters to and from entities such as
é. - Bytes and characters – UTF-8 encode, string to hex and text to binary show the bytes behind text.
- Compact encodings – Base32 (case-insensitive, used in TOTP secrets) and Base58 (no look-alike characters, used in cryptocurrency addresses and short IDs). Base64 has its own category.
- Tokens – JWT decode shows the header and payload of a JSON Web Token, including expiry times.
- Compression – gzip decompress and zlib tools read compressed payloads from logs and HTTP captures.
- Fun and learning – the Morse code translator and ASCII code tools.
Encoding is not encryption
Everything in this category is reversible by anyone: encodings exist for compatibility, not secrecy. A Base32 string, a URL-encoded value or a JWT payload can be decoded without any key. JWTs are signed, which proves they were not tampered with, but their contents are readable, so never put secrets in them. For actual encryption, see the hash and cryptography category.
Choosing between Base32, Base58 and Base64
All three turn bytes into text. Base64 is the most compact and the most widely supported. Base32 uses only uppercase letters and digits, so it survives case-insensitive systems and is easy to read aloud, which is why authenticator apps use it for secrets. Base58 removes look-alike characters such as 0, O, I and l, which reduces typing mistakes in identifiers people copy by hand.
Common debugging workflows
- A redirect or OAuth callback fails – decode the URL parameters to see what was actually sent; double encoding (
%2520instead of%20) is a frequent culprit. - An API rejects a token – decode the JWT and check the
exp,audandissclaims. - Strange characters in text – look at the hex bytes to tell a UTF-8 problem from a font problem; "é" instead of "é" is classic UTF-8 read as Latin-1.
- Compressed log payloads – decompress gzip data, then format the JSON inside.
Decoding happens locally in your browser, which matters for tokens and URLs that may contain session data.