Encode or decode UTF-8 text as Base64, URL-safe Base64, a URL component or HTML entities. Preview the result and copy or download it locally.
Your text is transformed entirely in your browser. The HTML entity library is self-hosted and the other formats use built-in browser APIs, so no uploads, external API, account or browser storage are needed. Decoded content is displayed as plain text.
No. Anyone can decode these representations. They do not provide secrecy, password protection or proof of authenticity. HTML entity encoding is also not a general-purpose sanitizer for every HTML or script context.
Encoding converts text into UTF-8 bytes before Base64. Decoding requires valid UTF-8 and reports invalid byte sequences rather than substituting damaged characters. A UTF-8 BOM is preserved as a character. This tool handles text, not images or arbitrary binary files.
Standard Base64 uses + and /; URL-safe Base64 uses - and _. URL-safe encoding omits padding. Decoding accepts valid padded or unpadded input and ignores ASCII whitespace. Invalid alphabet characters, malformed padding, impossible lengths and nonzero unused padding bits are rejected.
No. It uses URL-component encoding and decoding, so a literal + stays +, while %20 decodes to a space. This is not application/x-www-form-urlencoded decoding, and it does not parse a complete URL or a query string into fields.
The self-hosted he 2.0.0 library encodes HTML-sensitive and non-ASCII characters and decodes named or numeric HTML references in strict mode. Invalid references are rejected; valid references need their required semicolons. Decoding applies one layer only: &lt; becomes <, not a less-than sign. Markup is shown as text and never executed.
Encoding accepts up to 50,000 UTF-16 text units; decoding accepts up to 500,000 to accommodate encoded expansion. Input is not truncated. Some emoji use multiple units. Browser textareas normalize pasted line endings to LF, and TXT exports use the displayed result. No output is saved when you leave or reload the page.
