Encoding & Decoding Tools
9 toolsEncoding is the process of transforming data from one format to another for compatibility, transmission, or storage — and it is a fundamental concept every developer encounters, whether embedding images in CSS with Base64 data URIs, percent-encoding special characters in URL query strings, escaping HTML entities to prevent XSS vulnerabilities, or inspecting JWT tokens during API authentication debugging. These tools cover the encoding operations developers perform most frequently: Base64 encoding and decoding for text and images, URL percent-encoding for safe query parameter construction, HTML entity encoding for cross-site scripting prevention, JWT decoding for token inspection without signature verification, and SHA-1/SHA-256/SHA-512 hash generation for data integrity checks. A critical distinction to understand is that encoding is not encryption — Base64 and URL encoding are fully reversible without any secret key, and they provide zero confidentiality. Every tool on this page uses the Web Crypto API where cryptographic operations are involved and runs entirely in your browser, ensuring complete privacy for your sensitive data.
No tools in this category match “”.
Search all tools insteadCommon Use Cases
Debug JWT tokens from API authentication responses to check claims and expiration
Base64-encode images for embedding as CSS data URIs or inline in HTML
Generate SHA-256 checksums for file integrity verification and data validation
URL-encode query parameters containing special characters for safe API requests
Decode Base64-encoded API payloads during integration debugging
Escape HTML entities in user-generated content to prevent XSS attacks
Verify bcrypt password hashes against known inputs for security testing
Frequently Asked Questions
What is the difference between encoding and encryption?
Encoding transforms data into a different format for compatibility (like Base64 for binary-to-text), and is fully reversible without a key. Encryption transforms data to protect confidentiality and requires a secret key to reverse. Base64 is encoding, not encryption — anyone can decode it.
Can I use these tools to encode sensitive data safely?
These tools run locally in your browser and never transmit data, so they are safe to use with sensitive content. However, remember that encoding (Base64, URL encoding) does not provide security — it is not encryption. Do not rely on encoding to protect secrets.
Which hash algorithm should I use for password storage?
None of the hash algorithms available here (SHA-1, SHA-256, SHA-512) are suitable for password storage on their own. Use a dedicated password hashing function like bcrypt, scrypt, or Argon2 that includes salting and key stretching. The hash tools here are best for checksums and data integrity verification.
What is a JWT token and why would I need to decode one?
A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and authorization in modern web applications. It contains three parts: a header (algorithm info), a payload (user claims like user ID, roles, and expiration), and a signature. Developers frequently need to decode JWTs during debugging — to check if a token has expired, verify the claims it carries, or inspect which algorithm was used. The JWT Decoder on this page lets you inspect token contents without verifying the signature, making it a fast debugging tool.
When should I use Base64 encoding vs. URL encoding?
Base64 encoding is used to represent binary data (like images, files, or arbitrary byte sequences) as ASCII text — common in email attachments (MIME), data URIs in HTML/CSS, and embedding binary content in JSON. URL encoding (percent-encoding) is used specifically to make text safe for inclusion in URLs by escaping reserved characters like &, =, ?, and spaces. Use Base64 when you need to embed binary data in text formats; use URL encoding when building URLs and query strings.
Why does the same text produce different hashes with SHA-256 vs SHA-512?
SHA-256 and SHA-512 are different algorithms in the SHA-2 family that produce different output sizes: SHA-256 generates a 256-bit (64-character hex) hash, while SHA-512 generates a 512-bit (128-character hex) hash. They use different internal round functions and word sizes. The same input will always produce the same hash within the same algorithm, but the outputs between algorithms are completely unrelated. Choose SHA-256 for general-purpose integrity checks and SHA-512 when you need a longer hash for higher collision resistance.
How do HTML entities prevent cross-site scripting (XSS) attacks?
XSS attacks occur when user-supplied content containing HTML or JavaScript is rendered unescaped in a web page. By encoding characters like < as <, > as >, and & as &, the browser displays them as literal text instead of interpreting them as HTML markup or script tags. This is a critical first layer of defense, but context-aware encoding (different encoding for HTML content, JavaScript strings, URLs, and CSS values) is required for comprehensive XSS prevention.
Related Tool Categories
Related Guides
Developer Generators: The Tools That Save You Hours Every Week
A practical guide to the generators every developer needs — UUIDs, passwords, QR codes, favicons, meta tags, robots.txt, .gitignore, and more. Learn when, why, and how to use each one.
Web Security: Encoding and Hashing Guide
Understand the differences between encoding, hashing, and encryption. Learn when to use Base64, SHA-256, bcrypt, AES, and HTML entity encoding for web security — with code examples and decision flowcharts.
JWT Security: What's Safe to Decode, and What You Should Never Paste Online
A JWT is just Base64 — anyone can read it. What that means for inspecting tokens safely, why pasting a live token into a random website is risky, how signature verification actually protects you, and what belongs in a token.
How to Verify a File's Checksum (SHA-256) and Why It Matters
What a checksum is, how to verify a downloaded file's SHA-256 hash on macOS, Windows, and Linux, what it actually catches, and the limit of trusting a hash published next to the file.
Are Online PDF Tools Safe? Server Upload vs In-Browser Editing
What actually happens when you upload a PDF to an online tool — server retention, breach exposure, and jurisdiction — and how in-browser PDF editing avoids it. With a practical way to verify any tool yourself.
Base64 Encoding vs Hashing: Clearing the Ultimate Cryptography Confusion
Understand the critical difference between Base64 encoding (data transformation) and hashing (cryptographic security). Learn when to use SHA-256, bcrypt, and Argon2.
HTTP Security Headers: The Complete Checklist for Your Web App
A definitive engineering guide to HTTP Security Headers. Master Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, and defend against XSS, clickjacking, and MIME sniffing attacks.
DNS Records Explained: What Every Developer Should Know
A practical guide to DNS records: A and AAAA resolution, the CNAME apex constraint, SPF/DKIM/DMARC email authentication, TTL strategy, and DNSSEC.
cURL for Developers: The Commands You'll Use Every Day
A definitive engineering guide to cURL for backend architects. Master complex OAuth authentication, multipart binary data uploads, deep TLS handshake debugging, network latency profiling, and HTTP header architectures.
Environment Variables and Config Management: A Developer's Guide
A practical guide to environment variables: the 12-Factor App approach, Zod schema validation, Docker ARG vs ENV security, and managing production secrets.
IP Subnetting Demystified: A Practical Guide to CIDR and Subnet Masks
A practical guide to IP subnetting from the ground up: CIDR notation, the binary math behind subnet masks, VPC design on AWS, VLSM, and mental-math tricks to skip the subnet tables.
SSL/TLS Certificates: What Developers Should Know
A practical guide to SSL/TLS certificates: the TLS handshake, the chain of trust, ACME/Let's Encrypt automation, debugging missing intermediates, and hardening Nginx.
UUID vs NanoID vs ULID: Picking the Right ID for Your Project
A definitive architectural guide to database primary keys. Learn why UUID v4 destroys B-Tree indexing performance, the mathematical collision risks of NanoID, and why time-sorted ULIDs (and UUIDv7) are the future of backend infrastructure.
CORS Errors Explained: Why Your Fetch Call Fails and How to Fix It
A practical guide to CORS: the Same-Origin Policy, debugging OPTIONS preflight requests, the wildcard-plus-credentials paradox, and securing it with an Nginx reverse proxy.
Password Security: Generation, Hashing, and Storage Best Practices
A guide to password security: information entropy, bcrypt vs Argon2id hashing, salting to defeat rainbow tables, and the current NIST guidelines.
Base64 Encoding Mistakes That Silently Break Your App
Common Base64 bugs and how to fix them: Base64URL safety for JWTs, padding inconsistencies, the UTF-8 btoa() crash, and why Base64 is the wrong tool for large file uploads.
API Rate Limiting: How It Works and How to Handle It
A practical guide to API rate limiting: how token buckets and sliding windows work, implementing them in Redis with atomic Lua scripts, and writing client retry logic with exponential backoff and jitter.
TypeScript Type Checking: Common Mistakes and How to Fix Them
A practical guide to TypeScript's common type-checking mistakes: discriminated unions, exhaustive checks with the 'never' type, Zod runtime validation, generics, and strict tsconfig rules.
Linux File Permissions & chmod: A Developer's Practical Guide
Master Linux file permissions, octal notation, and chmod commands. Covers standard permission patterns for web servers, SSH keys, Docker, CI/CD, and advanced SUID/SGID concepts.
bcrypt vs SHA-256: Password Hashing Compared
Why SHA-256 is wrong for password storage and bcrypt is right. Learn about salting, key stretching, and modern password hashing best practices with real benchmarks and implementation examples.
Git Best Practices Every Developer Should Know
A practical guide to Git collaboration: semantic commits, trunk-based vs GitFlow, rebasing, automating conflict resolution with `git rerere`, and Husky pre-commit hooks.
XSS Prevention with HTML Entity Encoding
The definitive engineering guide to Cross-Site Scripting (XSS). Master Context-Aware HTML Entity Encoding, Content Security Policy (CSP) nonces, DOM-based attacks, and the Trusted Types API to eradicate injection vulnerabilities.
Why Base64 is Not Encryption
Why Base64 encoding provides no security: how the algorithm works, the real Kubernetes/JWT misconceptions, and how to use AES-256-GCM and bcrypt instead.