Encode & Decode Toolkit
Base64, URL, HTML entities, hex, hashing, and JWT decoding, all in one place. Runs entirely in your browser: nothing is uploaded.
Operation:
Direction
Converts text into Base64, a format commonly used to safely embed binary or text data in JSON, URLs, and config files.
What Marketers Actually Use These For
These aren't just developer trivia. Most marketing stacks run into every one of these at some point, usually while debugging why a link, an integration, or a report isn't behaving.
Base64
Encodes raw bytes into plain text.
It's not encryption; anyone can decode it just as easily.
Use this to:
- Read webhook payloads and API responses
- Embed a small image directly in an email template
- Pass binary data through a system that only accepts text
URL Encoding
Makes a value safe to sit inside a URL, the same encoding our UTM Builder applies automatically.
Use this to:
- Encode a campaign name or value that has a space, &, or emoji
- Pass a full destination URL as another link's query parameter
- Build or debug a tracking link by hand
HTML Entities
Escapes characters like & and " so they render as text.
Decoding does the reverse, turning entities back into normal characters.
Use this to:
- Escape landing page copy with trademark symbols or curly quotes
- Fix an email template that keeps breaking its own markup
- Stop a stray & from cutting off the rest of a CMS field's value
Hex
Shows exactly what bytes are in something.
Each byte becomes two characters, 0-9 and a-f, so it's easy to scan by eye.
Use this to:
- Make sense of an export or API response that looks like garbled text
- Track down a character-encoding issue in a data file
- Inspect a raw payload byte by byte
Hashing
Turns a value into a one-way fingerprint.
The same input always produces the same hash, but it can't be reversed back to the original.
Use this to:
- Upload contacts for Google Enhanced Conversions or Meta Customer Match
- Generate a stable cache-busting value for a static asset
- Create a consistent ID without storing the original value
JWT Decoding
Reads the header and payload of an auth token.
The three dot-separated parts are just Base64URL; no secret key is needed to read them.
Use this to:
- Debug a CRM API or ad platform integration that's suddenly failing
- Check whether a token has actually expired
- Confirm a token has the scopes you expect
Common Questions
Is anything I paste in sent to a server?
No. Every conversion runs in your browser with JavaScript. Nothing you type or paste here is ever sent anywhere, which matters if you're working with tokens, keys, or other sensitive values.
What is Base64?
Base64 represents binary data using only 64 printable ASCII characters (A-Z, a-z, 0-9, +, /). It doesn't compress or encrypt anything; it just re-encodes bytes into a format that's safe to put in text-only systems like JSON, email, or a URL.
What is URL encoding?
URL encoding, also called percent-encoding, replaces characters that aren't safe inside a URL, like spaces and &, with a % followed by their hex value. It keeps a URL from breaking when a value inside it happens to contain one of those characters.
What is HTML entity encoding?
HTML entities are text-safe stand-ins for characters that have special meaning in HTML, like & becoming & and < becoming <. Without escaping them, a browser tries to interpret those characters as markup instead of displaying them as text.
What is hex encoding?
Hex, short for hexadecimal (or base16), represents each byte of data as two characters using 0-9 and a-f. It's a direct, human-readable view of raw bytes, commonly used for debugging, checksums, and low-level data inspection.
Why did hex decode fail on my input?
Hex-encoded bytes always come in pairs of characters, so an odd number of hex digits, or a character outside 0-9 and a-f, means the input isn't valid hex. Whitespace between byte pairs is fine and gets ignored.
What is hashing?
Hashing runs a value through a one-way algorithm, like SHA-256, to produce a fixed-length fingerprint. The same input always produces the same hash, but the process can't be reversed to recover the original value from it.
Why include MD5 and SHA-1? Aren't they insecure?
Both are broken for security purposes like password storage or signatures, since collisions can be engineered. They're still genuinely useful for non-security tasks: checksums, cache keys, deduplication, and verifying a file wasn't corrupted in transit. Use SHA-256 or better for anything security-sensitive.
What is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe token made of three Base64URL-encoded parts, a header, a payload, and a signature, commonly used to pass identity or permission claims between a client and a server.
Does the JWT decoder verify the token?
No. It decodes the header and payload so you can read the claims, but it doesn't check the signature. A decoded token can still be fake or tampered with. Never treat a decoded payload as trustworthy without verifying the signature server-side first.