← Takora

Base64 / URL / HTML / Unicode Encode & Decode

Base64

Base64 encoding still runs the web — here is how to get it right

Base64 is the encoding scheme that lets binary data travel through text-only channels: email attachments, JSON payloads, HTTP headers, and data URLs in CSS or HTML. Almost every developer hits the moment where a string of gibberish like aGVsbG8= has to become hello — or the reverse — and doing it by hand invites silent corruption. This tool converts Base64 to and from plain text with proper UTF-8 handling, so accented characters, emoji, and non-Latin scripts survive the round trip instead of turning into mojibake.

You need it whenever you debug an API response, inspect a JWT segment, decode an image embedded as a data URL, or store binary values in a text column. Unlike terminal one-liners, it shows you the decoded text immediately and handles the padding and alphabet details for you.

Encode Text to Base64 in Four Steps

  1. Open the Base64 Encode/Decode tool on the Takora encode page.
  2. Paste or type the plain text you want to encode in the input box.
  3. Click the Encode button and confirm the output starts with a recognizable prefix such as aGVsbG8= for hello.
  4. Copy the encoded result — it is safe to paste into JSON, URLs, or email bodies.
  5. If the text came from another system, compare the first few characters with a known-good sample before trusting it.
  6. For long payloads, encode in chunks and reassemble, or verify the length is a multiple of four.

Decode a Base64 String

  1. Paste the Base64 string — with or without trailing = padding — into the decode field.
  2. Click Decode and read the output; UTF-8 text should appear exactly as originally written.
  3. If the output shows replacement characters, the input was probably encoded from bytes that were never valid UTF-8 text.
  4. Check whether the string uses the URL-safe alphabet (- and _) and swap it back to standard + and / if needed.
  5. Look for line breaks inside the input; many mail clients wrap Base64 at 76 characters and the tool strips them automatically.

Real Example: A JWT Payload and an Image Data URL

JWT payloads are Base64url-encoded JSON. Decoding the middle segment of a token reveals the claims object, which is the fastest way to inspect an expired or rejected token during debugging. Likewise, a data URL such as data:image/png;base64,iVBORw0KGgo= embeds image bytes directly in HTML; decoding the tail verifies what the browser actually received.

OperationInputOutput
EncodeHello, 世界!SGVsbG8sIOS4lueVjCE=
DecodedGFrb3JhIHRvb2xztakora tools

Tips for Clean Base64 Results

When Base64 Makes Sense

Base64 Questions Developers Actually Ask

Is Base64 the same as encryption?

No. Base64 is an encoding that preserves data in a reversible, publicly documented way. Encryption requires a key; Base64 requires nothing and provides no confidentiality.

Why does my decoded text show question marks?

The encoded bytes are not valid UTF-8 text, or the original was a binary file such as an image. Decode only strings that were originally text, and check the source encoding.

What is the difference between Base64 and Base64url?

Base64url replaces + with - and / with _ and drops padding, so the output is safe in URLs and filenames. JWT and OAuth tokens use Base64url.

Can I encode a file with this tool?

The tool works on text input. For binary files, use the Image to Base64 tool for images, or read the file as text if it is UTF-8 safe.

Why does the encoded output end with one or two equals signs?

Padding bytes make the output length a multiple of four. One = means one leftover byte, two mean two leftover bytes; some decoders accept missing padding.

Does Base64 work for non-English text?

Yes, as long as the text is encoded as UTF-8 first. The tool handles UTF-8 input, so accented letters, CJK characters, and emoji round-trip correctly.

Is there a size limit for encoding?

Very large inputs may slow the browser. For multi-megabyte payloads, split the text into chunks and encode each one separately.

Why is the encoded string longer than the original?

Base64 uses 64 symbols to represent 6 bits per character instead of 8, so the output grows by roughly a third. That overhead is the price of text safety.

Percent-encoding is why your URLs break — decode and encode with confidence

URLs can only carry a restricted set of ASCII characters, yet real-world links are full of spaces, ampersands, slashes, and Unicode text. Percent-encoding — also called URL encoding — replaces those characters with a % followed by two hex digits, so ? becomes %3F and a space becomes %20. This tool encodes and decodes URLs and query strings in both directions, which saves you from the classic failure where a search term with & silently swallows the rest of a query parameter.

Reach for it when you build links programmatically, debug redirects, parse referrer logs, or paste an ugly encoded URL and want to know what it actually points to.

How to Percent-Encode a URL

  1. Paste the raw URL or query string into the input field.
  2. Choose encode mode — the tool will convert unsafe characters to their %XX forms.
  3. Review the result: spaces become %20 (or + in query strings), & becomes %26, and = becomes %3D.
  4. Verify that reserved delimiters you want to keep — like the ? that starts the query — were left alone.
  5. Copy the encoded value into your code or link.
  6. If you only need one parameter value encoded, encode the value alone, not the whole query string.

Decoding an Opaque URL

  1. Paste the encoded URL, such as https%3A%2F%2Ftakora.dev%2Fsearch%3Fq%3Dhello%20world.
  2. Switch to decode mode and click the button.
  3. Read the human-readable URL and check that slashes, colons, and question marks came back.
  4. Watch for double-encoding — a literal %25 in the output means the original was encoded twice.
  5. Use the decoded form to verify what a redirect or tracking link really contains before clicking in a browser.

Real Example: Fixing a Broken Search Link

A generated link /search?q=fish & chips truncates at the ampersand because & separates parameters. Encoding the value gives /search?q=fish%20%26%20chips, and the server receives the full phrase as one parameter. The table shows the before and after.

ContextRawEncoded
Query valuea & b = ca%20%26%20b%20%3D%20c
Path segment/docs/new file.pdf/docs/new%20file.pdf

Practical Encoding Tips

When You Will Reach for URL Encoding

Frequently Asked Questions

What characters must be percent-encoded in a URL?

Anything outside the unreserved set — letters, digits, -, _, ., ~ — plus reserved delimiters when they appear inside a value. Spaces, &, #, and non-ASCII text are the usual culprits.

Why do I see %20 in some URLs and + in others?

In the query string, + historically means space (application/x-www-form-urlencoded). In path segments, only %20 is valid. Browsers and servers usually accept both in queries.

Is URL encoding the same as HTML encoding?

No. URL encoding uses %XX for transport, while HTML encoding uses entities like & to prevent markup injection. The two are not interchangeable.

Why does my encoded value still break the query?

You probably encoded the whole URL instead of individual values, so the & separators were also encoded and the server sees one giant parameter.

How do I encode a slash inside a path segment?

Use %2F. Note that some servers and proxies decode it back to a real slash before routing, which can change the path — test against your stack.

Can URL encoding hold Unicode characters?

Yes, after converting the text to UTF-8 bytes. Each byte becomes a %XX triple, so a single character like 世 becomes %E4%B8%96.

What does double-encoding look like?

An encoded % appears as %25. Decode it once and you get %3F; decode twice and you get ?. If the output still contains %25, your input was encoded twice.

Does the tool handle mailto or data URLs?

Yes, the same percent-encoding rules apply. For data URLs, the Base64 section after the comma should be handled by the Base64 tool instead.

HTML entity encoding is your first line of defense against broken pages

HTML treats <, >, &, and quotes as markup, not text. When user input or dynamic data contains those characters, the browser parses them as tags or attributes — breaking layouts, corrupting JSON inside scripts, and opening the door to cross-site scripting. HTML entity encoding converts those characters into safe sequences like &lt;, and decoding reverses the process. This tool does both, which is essential whenever you render user-generated content, escape strings for email templates, or untangle data that a CMS mangled.

Use it any time you paste text into a web page and the output looks wrong, or when an editor keeps converting your & into something unexpected.

Escaping Text for Safe Display

  1. Paste the raw text — a comment, a name, or a code snippet — into the input box.
  2. Choose the encode (escape) direction.
  3. Confirm that < became &lt;, > became &gt;, and & became &amp;.
  4. Insert the escaped string into your HTML template or email body.
  5. For attribute values, also verify quotes are escaped to &quot;.
  6. Test the rendered page to make sure the text displays literally instead of being interpreted.

Unescaping Entity-Heavy Content

  1. Paste content full of entities, such as &lt;script&gt;.
  2. Switch to decode mode and run the tool.
  3. Read the restored text and confirm angle brackets and ampersands came back.
  4. Beware of double-escaped data — &amp;lt; decodes to &lt;, not to <.
  5. Use the result to inspect what a database or editor actually stored.

Real Example: Storing a Code Comment Safely

A user submits the comment Use <b> tags sparingly & keep it simple. Rendered raw, the browser treats <b> as real markup. Escaping produces Use &lt;b&gt; tags sparingly &amp; keep it simple, which displays exactly as typed and is safe to store and re-render.

Raw textEscaped
5 < 10 && ok5 &lt; 10 &amp;&amp; ok
say "hi"say &quot;hi&quot;

Tips for Reliable Entity Handling

Where Entity Encoding Matters Most

Entity Encoding Questions

Does escaping prevent all XSS attacks?

Escaping blocks markup injection in HTML contexts. It does not protect JavaScript contexts, URLs, or CSS by itself — use context-specific encoding for each of those.

Why does my text show &amp; on the page?

Your data was escaped twice: once when stored and once when rendered. Decode once more, or stop escaping at the storage layer.

Should I escape single quotes too?

Yes, in attribute values delimited by single quotes, or when the value ends up inside a JavaScript string. The entity is &#39;.

What is the difference between &lt; and < in HTML source?

&lt; is an entity that renders as the < character; a literal < starts a tag. The browser treats them completely differently.

Does this tool handle numeric entities like &#233;?

Yes. Numeric character references decode to their Unicode characters, which is handy for inspecting content generated by older systems.

Can I escape text for a JSON API response here?

No — JSON needs its own escaping (quotes and backslashes). Use the JSON Formatter tool for JSON-specific work instead.

Why does my email subject show &amp; instead of &?

Email clients render the subject as HTML. The subject line was escaped once too many, or the sending library escaped it without being asked.

Is entity encoding reversible?

Yes, it is a one-to-one mapping for the core entities. Decoding restores the original characters, provided the data was not double-escaped along the way.

Turn \uXXXX Unicode Escapes Into Readable Text and Back

JSON payloads, JavaScript string literals, Java properties files, and Python source all encode non-ASCII characters as backslash-u sequences such as \u00e9. Reading a payload full of escapes is painful, and hand-writing them is worse: one wrong hex digit silently corrupts a string. The Unicode Escape tool converts between plain text and \uXXXX escape sequences in both directions, so you can decode a scrambled API response into readable text or encode a string for embedding in source code. It handles the full Unicode range, including characters outside the Basic Multilingual Plane such as emoji and rare scripts, which need the surrogate-pair form. Everything runs locally in your browser, and it works on any text fragment, so you never have to write a throwaway script just to read one escaped string.

How to Encode or Decode Unicode Escapes

  1. Choose the direction: Escape (text to \uXXXX) or Unescape (escapes back to text).
  2. Paste your input — plain text like café, or escaped text like caf\u00e9.
  3. Press the Convert button and read the result in the output panel.
  4. Copy the converted string with the copy button and drop it into your code or configuration file.
  5. For characters above U+FFFF, inspect how the tool emits surrogate pairs such as \ud83d\ude00 and confirm your target language accepts them.
  6. Mix escaped and plain segments in one input — the tool leaves already-readable characters untouched while decoding only the escape sequences.

Real Example: Escaped and Unescaped in Both Directions

JavaScript string literals commonly store accented text as escapes to keep source files pure ASCII. The tool converts the escaped form caf\u00e9 into the readable string café, and running it in reverse turns café back into caf\u00e9. For CJK text, each character becomes one four-digit escape, so 你好 becomes \u4f60\u597d.

OperationInputOutput
Unescapecaf\u00e9café
Escapecafécaf\u00e9
Escape你好\u4f60\u597d
Unescape\u4f60\u597d你好

Note that the escaped output uses lowercase hex digits, which is the most common convention in generated code. If your toolchain emits uppercase \u00E9 instead, the decoder accepts both cases on input.

Unicode Escapes vs HTML Entities vs Percent Encoding

Tips for Working With Unicode Escapes

When to Use Unicode Escape Conversion

Unicode Escape FAQ

What does \u00e9 mean?

It is a Unicode escape: the backslash-u prefix followed by four hexadecimal digits that identify code point U+00E9, which is the letter é. Decoding the escape yields the character é, and encoding é in reverse produces \u00e9.

Is a Unicode escape the same as an HTML entity?

No. A Unicode escape like \u00e9 is used inside source code and JSON strings. An HTML entity like &eacute; or &#233; is used inside markup so browsers display the character. They serve different layers and are not interchangeable.

How do I encode a character outside the Basic Multilingual Plane?

Characters above U+FFFF are encoded as a surrogate pair of two escapes, for example \ud83d\ude00 for the grinning face emoji. The tool emits both halves automatically so the pair round-trips correctly.

Why does my JSON show \u00e9 instead of é?

Because the JSON was generated by a tool that escapes non-ASCII characters to keep the payload pure ASCII. That is valid JSON — \u00e9 and é are equivalent — and many parsers accept either form. Decode it with this tool to read the text.

What is the difference between \u and \x escapes?

\u takes exactly four hex digits and maps to a Unicode code point, such as \u00e9. \x takes two hex digits and maps to a single byte, such as \xe9, which is encoding-dependent. Unicode escapes are the portable choice across languages and encodings.

Can I decode a string that mixes escapes and plain text?

Yes. The decoder processes the whole input and converts every \uXXXX sequence while leaving plain characters untouched, so something like caf\u00e9 au lait decodes cleanly to café au lait.

Are uppercase hex digits like \u00E9 valid?

Yes. The hex digits are case-insensitive, so \u00E9 and \u00e9 decode to the same character. The tool accepts both on input and emits lowercase on output for consistency.

Why is my emoji encoded as two escapes?

Emoji and other characters above U+FFFF do not fit in the four hex digits of a single \uXXXX escape, so the encoding splits them into a surrogate pair of two escapes. Decode the pair together to recover the original character.

When should I use percent encoding instead of \u escapes?

Percent encoding like %C3%A9 belongs in URLs and query strings, where the URL Encode tool is the right fit. Unicode escapes belong in source code and JSON. Using the wrong one in either place produces broken strings.

Related Tools