Utilities
Decode Base64, URL percent-encoding, HTML entities, Unicode escapes, hexadecimal bytes and binary back into text — one page with a type selector instead of six. Invalid input is reported instead of guessed at, and UTF-8 is handled properly, so Bangla, accented letters and emoji come back exactly as they went in. Runs entirely in your browser; nothing is uploaded.
Up to 262,144 bytes. Line breaks and separators are fine — paste it as it is.
Paste something, then press Decode.
Base64 → bytes → UTF-8 text.
Line breaks and spaces are ignored, so wrapped Base64 pastes in as it is, and a missing "=" at the end is accepted. The URL-safe alphabet ("-" and "_") is not, because it means something different.
Decoding happens locally in your browser. Your text is not uploaded, not stored and not sent anywhere, and nothing you paste appears in the page address. Decoding is not decryption — it reverses a way of writing text, not a lock. There is no key involved, and anything decoded here can be decoded by anyone else just as easily.
Looking for something else? Browse all tools.
Decode Base64, URL percent-encoding, HTML entities, Unicode escapes, hexadecimal bytes and binary back into readable text — with the reading chosen explicitly, because a decoder that guesses gives you confident nonsense instead of an error.
The common case is a value that arrived from somewhere else — a token, a payload field, a link — and you want to know what it says. Nothing is guessed here: you pick the type, and the decoder either shows what the value says or names the reason it is not valid for that type. When you do not know which encoding it is, trying the candidates in turn costs one click each — and a failed decode is worth more than a successful-looking wrong one.
Decoding invalid input produces an error here rather than silent rubbish. A string of characters that is not valid Base64, or a URL escape that is truncated, is reported as a problem with the input. That distinction matters: a decoder that returns *something* for every input makes a malformed value look like a successful decode.
Values are often encoded more than once — a URL-encoded string inside a Base64 blob, for instance. When the output still looks encoded, decode it again with the second type; the type selector makes that a two-step operation rather than something you need another tool for.
Decoding happens in the page. There is no request, so a token or payload you are inspecting is not transmitted anywhere — which is the reason to decode a credential locally rather than in a site that asks you to paste it in.
Because it is not valid for the encoding you selected. Base64 has a restricted alphabet and a length rule, URL escapes have to be complete and well-formed, and hex must be an even number of digits. The decoder reports the input as the problem rather than returning a plausible-looking wrong answer.
Base64 padding and line breaks from wrapped output are handled, because both are common in real payloads. What will still fail is genuinely invalid input — a character outside the alphabet, or a length that cannot be a valid Base64 string.
No, and no tool can. A hash is one-way by design, so there is nothing to decode back to. If you need to check a hash, hash a candidate value and compare the two — that is what the Hash Generator's check field is for.
