What this tool answers
Base64 and URL encoding show up in the middle of other work: a token in an authorization header, a callback URL with a space in it, a filename in a query string. This page converts both directions and handles UTF-8, so Chinese, emoji, and accented letters survive the round trip.
How to use it
Pick a mode, paste into the left box, and press Encode or Decode. Base64 uses the standard alphabet with padding. URL mode uses encodeURIComponent, which encodes everything except the unreserved characters and is the right choice for a query parameter value. If you need to encode a complete URL without touching its structure, encode the pieces separately rather than the whole string.
The Swap button moves the output back into the input and flips the direction, which is the fastest way to check that a round trip is clean. The copy button copies the result.
What it does not do
It does not encrypt. Base64 is an encoding, not a security control: anyone can decode it, and it should never hold a secret you would not print. It does not sign, hash, compress, or encrypt anything, and it does not guess the character set of a legacy payload. If decoding produces replacement characters, the input was probably not UTF-8; this tool will not silently reinterpret it.
It also does not send your text anywhere. The conversion is done with TextEncoder, TextDecoder, btoa, and decodeURIComponent in your browser.
Common mistakes
- Encoding an already encoded string.
%2520is a space that was encoded twice; decode once, not twice, unless you know the pipeline. - Using Base64 where the API expects Base64URL. The two differ in
+//versus-/_and in padding. This tool produces standard Base64. - Putting a full URL into URL mode. The
://and path separators will be encoded too, and the link stops working. - Treating a decoded token as verified data. Decoding proves nothing about who created it.