Base64, URL encoding, and HTML entities explained

Base64, URL encoding, and HTML entities all turn readable text into something less readable, which is why they get mixed up. They solve different problems, and using the wrong one produces values that look plausible and behave incorrectly.

Base64: moving bytes through text channels

Base64 represents binary data using 64 printable characters, so it can travel through systems that only handle text: JSON, email headers, data URLs, and database columns. It is an encoding, not encryption, and it grows the data by roughly a third. The URL-safe variant replaces+ and / so a value can appear in a URL or filename without percent-encoding.

Use Base64 encoder / decoder when you need to inspect what a token or attachment actually contains. If the input is not valid Base64, the decoder tells you instead of returning quietly corrupted text.

URL encoding: values inside URLs

Reserved characters in a URL have structural meaning. Percent-encoding makes a value safe to place in a query string or path. The subtlety is the space: paths and query components use %20, while form-encoded bodies use +. Choosing the wrong mode is a common source of double encoding, where a value like a bbecomes a%2520b after two passes.

URL encoder / decoder handles components, whole URLs, and form values separately, which makes the correct choice explicit. For editing the parameters themselves rather than the encoding, use Query string editor.

HTML entities: text that must not become markup

If user text is inserted into HTML without escaping, characters like< and & change the structure of the page. Entity encoding replaces those characters with references such as< and &. Named entities like  and numeric references both decode back to the original characters.

HTML entity encoder / decoder treats decoded output as plain text, so pasted content cannot execute in your browser. That matters when you are inspecting hostile input.

Quick decisions

• Binary data that must survive a text channel: Base64.
• A value that will sit inside a URL: percent-encoding.
• Text that will sit inside HTML: entity encoding, or better, a templating system that escapes by default.
• A JWT, hash, or binary blob you want to understand: decode it with JWT decoder or Text to binary, keeping in mind that decoding proves nothing about authenticity.