Encoders & Decoders

Encoding turns bytes or text into a form that survives a channel with rules about which characters are allowed (a URL, an HTTP header, a JSON string). None of it is encryption: every encoding here is reversible with no key, which is exactly why a decoder is safe to run in your browser and why it can never tell you whether a token is genuine, only what it says.

Decode a JWT when an API call returns 401 and you want to see the claims and expiry the server saw. Use Base64 for Authorization: Basic headers, data URIs and anything that arrived as a block of letters ending in =; a JWT's segments are Base64URL, so the two tools overlap deliberately. Use URL encode/decode for query-string values. The most common mistake it prevents is running a whole URL through component encoding and escaping the slashes that make it a URL. When the Base64 is an image rather than text, the text decoder can only say “not UTF-8”: Base64 to Image shows the picture, names its real format and downloads it, and Image to Base64 goes the other way, from a file to a data URI, <img> tag or CSS url().