BrowserDevTools

Encode & decode toolbox

Paste one value per line and pick the encoding: you get a row per line, per-line errors instead of a silent “best guess”, a CSV/JSON export — and the command line that does the same thing, so you can repeat it in CI.

3 line(s) · 0 error(s)

Equivalent command line

printf '%s' 'Zm9vYmFy' | base64 -d

Quoted for you, so you can paste it straight into a terminal or CI. `printf` is used instead of `echo` because `echo` mangles backslashes and trailing newlines.

Values are processed in this tab only — no upload, no share link. Still, treat tokens you paste as secrets.

Result

✓ Converted without errors.

#InputOutput
1Zm9vYmFyfoobar
2aGVsbG8gd29ybGQ=hello world
35L2g5aW977yM5LiW55WM你好,世界

Notes

  • Nothing is uploaded: every conversion is a string operation in this tab.
  • Decoding is strict: invalid input is reported per line rather than silently repaired.
  • “Decode” reverses an encoding — it does not decrypt. Hashes, HMAC, AES-GCM and TOTP live in the companion crypto toolbox.

Why a toolbox instead of twelve pages

Encoding is a solved problem, and search results reflect that: a page per encoding, each one a single input box that gives you one answer. What they do not give you is the thing that actually eats time — doing it to forty rows, and then explaining to a colleague (or to CI) exactly how the string was produced.

So this page is deliberately shaped like a batch job rather than a single converter:

Everything runs in your tab: nothing is uploaded, there is no share link, and no value you paste ever reaches a server — which matters for the strings people actually want to decode here (tokens, cookies, payload fragments). Two honest limits: “decode” means reversing the encoding, not decrypting anything, and this page deliberately leaves out byte-level work — hashing, HMAC, AES-GCM and TOTP live in the companion crypto toolbox because they need Web Crypto and are asynchronous.

FAQ

Is anything uploaded?
No. Every conversion is a string operation in your browser tab. There is no backend endpoint, no logging and no share link, which you can confirm in the Network panel.
Can it decode a JWT or a cookie?
A JWT is three Base64URL segments: paste the payload segment here with Base64URL selected and you get the JSON back. The dedicated JWT batch decoder adds the claims analysis (exp, alg, security notes) on top — this page is the raw encoding layer.
Why does decoding sometimes fail?
Because the input is genuinely not that encoding. Base64 rejects characters outside its alphabet and impossible lengths; hex rejects an odd number of digits; URL decoding rejects a “%” that is not followed by two hex digits; text that is not valid UTF-8 is refused rather than shown as replacement characters. Failing loudly is the feature — a silent repair produces a wrong value that looks right.
What is the difference between the two URL encodings?
encodeURIComponent escapes everything that is not unreserved, so it is what you use for a query-string value. encodeURI keeps the structural characters (/, ?, &, =) intact, so it is what you use for a whole URL. Choosing wrong is the classic way a query parameter gets double-encoded.
Does it handle multi-byte characters and emoji?
Yes. Base64, hex and binary operate on the UTF-8 bytes, so 中文 and 🚀 round-trip correctly; \uXXXX escapes emit surrogate pairs for astral characters exactly as JavaScript source would. The one caveat: an encoding/decoding pair is only reversible when the decoded bytes are valid UTF-8 text.