How to convert between text encodings

Base64, hex and percent-encoding all answer the same question: how do I move arbitrary bytes through something that only accepts text?

These are not encryption and they are not compression. They are ways of writing bytes using a restricted set of characters, so the bytes survive a channel that would otherwise mangle them. Anyone can decode them; that is the point.

Step-by-step

1. Paste your input and say what it is.
2. Choose the output form.
3. Read the result, or the reason it was refused.

Which is which

• Base64 — three bytes become four characters, about 33% larger. The standard way to put binary in JSON, email or a data URI.
• Base64url — the same, with + and / replaced by - and _ so it is safe in a URL. JWTs use this.
• Hex — two characters per byte, so exactly double the size. Easy to read, common for digests and keys.
• Base32 — case-insensitive and avoids easily confused characters, which is why TOTP secrets use it.
• Percent-encoding — for URLs, where a space becomes %20.

Unicode is where this goes wrong

Encoding operates on bytes, but you typed characters, so something must turn one into the other. That something is UTF-8, and getting it wrong is the source of most encoding bugs. An emoji is one character and four bytes; an accented letter is one character and two. The converter carries text through UTF-8 properly and shows both counts, so the discrepancy is visible rather than mysterious.

Malformed input is refused, not guessed at

Base64 that is the wrong length, or contains characters outside its alphabet, is rejected with a reason rather than silently repaired. Guessing produces plausible-looking output that is quietly wrong, which is far worse than an error message — particularly when what you are decoding is a key.

Frequently asked questions

Is Base64 a form of encryption?

No. There is no key and it is trivially reversible by anyone. It exists to move bytes through text-only channels, not to hide anything.

Why does my decoded text look like nonsense?

Usually the input was not what you thought — Base64url decoded as standard Base64, or hex with stray separators. It can also mean the underlying bytes are not text at all.

What is the difference between Base64 and Base64url?

Only two characters. Base64url swaps + and / for - and _ so the result is safe inside a URL. Padding is often omitted too. JWTs use Base64url.