artisan.dev

Base64 & URL Encoder / Decoder

Input

How to encode and decode Base64, URLs and JSON strings

This encoder/decoder handles the three text encodings developers hit most often. The Base64 tab converts text to and from standard Base64 or the URL-safe Base64URL variant used in JWTs. The URL tab percent-encodes text for query strings and decodes %20-style sequences. The JSON tab escapes text so it can be embedded inside a JSON string, unescapes it again, and re-stringifies JSON with your chosen indentation.

All conversions are Unicode-safe — accented characters, CJK text and emoji round-trip correctly — and run entirely in your browser.

How to use it

  1. Pick the Base64, URL or JSON tab.
  2. Paste your input and choose Encode or Decode (for Base64, also choose Standard or URL-safe).
  3. Copy the output. Invalid input — for example a Base64 string with illegal characters, or a malformed % sequence — shows a clear error instead of garbage output.
InputOperationOutput
hello worldBase64 encodeaGVsbG8gd29ybGQ=
café ☕Base64 encodeY2Fmw6kg4piV
a+b/c?Base64URL encodeYStiL2M_
name=Ada Lovelace&x=1URL encodename%3DAda%20Lovelace%26x%3D1
line 1⏎line "2"JSON escape"line 1\nline \"2\""

When to use which encoding

  • Base64 — to carry binary or arbitrary text through text-only channels: data URIs, email attachments, Kubernetes Secrets, HTTP Basic auth headers, binary fields in JSON. Output is about 33% larger than the input.
  • Base64URL — the same idea with - and _ instead of + and /, and usually no = padding, so it is safe in URLs, cookies and file names. JWT segments use it.
  • URL (percent) encoding — for putting arbitrary text into a URL query parameter or path segment. It escapes reserved characters such as &, =, ?, /, # and spaces so they aren't mistaken for URL syntax.
  • JSON escaping — for embedding a block of text (a log message, an HTML snippet, a nested JSON document) as a string value inside JSON, where quotes, backslashes and newlines must be escaped.

None of these are encryption. Anyone can decode Base64 or percent-encoding without a key, so never use them to hide passwords or tokens.

Common errors

  • "Invalid Base64 string" — the input contains characters outside the alphabet, or it is Base64URL (-, _) being decoded as standard Base64. Switch to URL-safe mode, and remove any whitespace or data:…;base64, prefix.
  • Garbled characters after decoding (é instead of é) — the bytes were decoded with the wrong character set. This tool decodes as UTF-8; if the original was Latin-1 or Windows-1252, it was encoded incorrectly at the source.
  • URIError: URI malformed — a % is not followed by two hex digits, or the sequence isn't valid UTF-8. A literal percent sign must be encoded as %25.
  • + turned into a space — in HTML form encoding (application/x-www-form-urlencoded), + means space. This tool uses encodeURIComponent, which encodes spaces as %20 and + as %2B, so values survive both conventions.
  • Double-encoded URLs (%2520) — the value was encoded twice; %25 is an encoded %. Decode once more, then fix the code that encodes twice.

Encoding in code

// JavaScript (Unicode-safe Base64)
const b64 = btoa(String.fromCharCode(...new TextEncoder().encode("café")));
const url = encodeURIComponent("a&b=c");      // "a%26b%3Dc"
const esc = JSON.stringify("line 1\nline 2");  // → "line 1\nline 2" (quotes added, newline escaped)

# Python
import base64, urllib.parse, json
base64.b64encode("café".encode()).decode()
urllib.parse.quote("a&b=c", safe="")
json.dumps("line 1\nline 2")

For a deeper explanation of how Base64 works, padding, and the btoa() Unicode trap, read Base64 encoding explained.

Frequently asked questions

Is Base64 the same as encryption?

No. Base64 is a reversible encoding with a public alphabet. It hides nothing — anyone can decode it instantly.

What's the difference between Base64 and Base64URL?

Base64URL replaces + with - and / with _, and usually drops the = padding, so the result can be used in URLs and file names without further escaping. JWTs use Base64URL.

Should spaces in URLs be %20 or +?

%20 is correct everywhere in a URL. + means a space only in application/x-www-form-urlencoded query strings. Using %20 (as this tool does) is the safe choice.

Does this tool support emoji and non-Latin text?

Yes. Text is converted to UTF-8 bytes before Base64 encoding and decoded as UTF-8 afterwards, so any Unicode text round-trips correctly.

Further reading

Related tools