Encoding changes representation, not secrecy
An encoding maps data into a representation that another system can transport or embed safely. Anyone who recognizes the encoding can reverse it without a key.
Choose the format for the destination
- Use Base64 for binary-to-text transport when the protocol expects its standard alphabet.
- Use Base64URL for URL and token segments where + and / are unsafe.
- Use percent encoding for individual URL components.
- Use HTML entities when reserved characters must appear as literal text in markup.
text
Base64: aGVsbG8rLw==
Base64URL: aGVsbG8tXw
URL: hello%20world
HTML: <strong>Check Unicode round trips
JavaScript strings are not raw bytes. Reliable Base64 workflows encode text as UTF-8 before Base64 conversion and decode those bytes back as UTF-8 afterward. Test with accented letters, emoji, and non-Latin scripts.
Frequently asked questions
Can Base64 protect an API key?
No. Base64 is immediately reversible and should never be treated as secret storage.
Why does Base64URL remove equals signs?
Padding is commonly omitted for compact URL-safe values. A decoder can restore the required padding before decoding.
Does HTML entity encoding sanitize every security risk?
No. Correct output handling depends on context. This tool only represents significant characters and does not replace a complete application security policy.