How to Encode/Decode Base64, URLs, HTML Entities & JWTs
Select your desired operation from the dropdown menu—Base64 Encode/Decode, JWT Token Inspector, URL Component Encode/Decode, or HTML Entity Encode/Decode—and paste your string into the input box. Click Load Sample JWT to see how JSON Web Token headers and payloads are unpacked locally.
Key Features & Capabilities
- Encode and decode UTF-8 safe Base64 strings without corrupting multi-byte emoji or international characters
- Inspect JSON Web Token (JWT) header and payload claims locally without exposing bearer tokens to external servers
- Escape and unescape URI components and HTML entities (&, <, >, ", ') for XSS-safe rendering
- Chain transformations effortlessly with 1-click input/output swapping
UTF-8 Safe Encoding & Offline JWT Claim Inspection
Standard browser functions like btoa() and atob() were designed for legacy Latin-1 strings and throw InvalidCharacterError exceptions when given UTF-8 text containing emoji, smart quotes, or non-Latin scripts. Our encoder converts strings through a UTF-8 Uint8Array byte pipeline first, ensuring 100% lossless round-trip Base64 encoding across all Unicode characters.
| Format / Standard | Specification | Primary Engineering Purpose | Security Note |
|---|---|---|---|
| Base64 (UTF-8 Safe) | RFC 4648 | Embedding binary/UTF-8 payloads in JSON, data: URIs, or HTTP headers | Encoding is NOT encryption; anyone can decode Base64 |
| JSON Web Token (JWT) | RFC 7519 | Inspecting alg, sub, exp, and iat claims in bearer tokens | Decode offline so live session tokens never hit external logs |
| URL Component Encoding | RFC 3986 | Safely passing query parameters containing &, =, ?, or spaces | Use encodeURIComponent for parameter values |
| HTML Entity Escaping | HTML5 Named Refs | Escaping <, >, &, ", ' before rendering code in HTML | Prevents Cross-Site Scripting (XSS) injection |
How to Inspect a JSON Web Token (JWT) Safely
A JWT consists of three Base64URL-encoded segments separated by dots: Header.Payload.Signature. Because bearer tokens grant direct access to authenticated APIs, pasting a live production JWT into a server-rendered debugging website is a major security risk. Selecting JWT Token Inspector in this tool decodes the JSON header and payload claims strictly inside your browser tab.
Frequently Asked Questions
Why does native JavaScript btoa() fail on emoji or accented characters?
btoa() treats each UTF-16 code unit as a single byte and throws an error if any character exceeds 0xFF. Our tool encodes strings into UTF-8 bytes via TextEncoder before applying Base64, preserving all Unicode symbols cleanly.
Does the JWT Inspector verify the cryptographic signature?
This tool decodes and formats the Base64URL Header and Payload JSON segments for instant claim inspection and verifies whether a signature segment is present. Cryptographic signature verification requires your backend secret or public JWKS key.
How can I chain multiple encodings together?
Click the "⇄ Swap Input / Output" button to move your current output directly into the input box, then select your next transformation mode.