Encoder / Decoder
Base64, URL, and Hex — encode or decode text both ways.
Base64, URL and hex encoding are not encryption. They are ways of rewriting data so it survives being sent through systems that only cope with plain text. Attackers lean on that confusion constantly: an encoded payload looks scrambled enough to slip past a bored reviewer while being trivially readable by anyone who recognises the format.
How to use it
- Pick a mode — Base64, URL or Hex.
- Paste your text into Input.
- Press Encode ↓ or Decode ↑.
- Use ⇅ Move output to input to chain conversions, which is how you unpick a value that was encoded twice.
What to take away
How to recognise each format
Base64 uses A–Z, a–z, 0–9, + and / and often ends in one or two = signs. URL encoding shows %20, %2F and similar. Hex is pairs of 0–9 and a–f, often twice the length of the original.
Encoding is not security
If you find a password, token or API key that is "protected" by Base64, treat it as fully exposed. That is a finding worth reporting, not a control.
Frequently asked questions
Is Base64 a form of encryption?
No. Encryption needs a key that an attacker does not have. Base64 needs nothing at all — anyone can reverse it in seconds, including with this page. It is an encoding, not a cipher.
Is it safe to decode sensitive data in an online tool?
Usually not, because most online encoders send your input to a server. This one does not: everything runs in your browser, so nothing leaves your machine. Check that claim on any tool you use — view the network tab and watch for requests while you type.
Why does my Base64 string end in one or two equals signs?
That is padding. Base64 works in three-byte groups, so when the input does not divide evenly the encoder pads the result. It carries no meaning and does not indicate anything about the content.
Where this fits in the course
This security tool pairs with Path 06 — Cryptography — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Base32 / Base85 Encoder — Encode or decode text in Base32 or Base85 — the less common encodings you'll still run into in CTFs.
- Hash Identifier — Paste a hash and get likely algorithms, guessed from its length and character set.
- Entropy Calculator — Shannon entropy of any text — a genuine static-analysis signal for spotting packed or encrypted data.
- Cipher Playground — Caesar/ROT, XOR, and Vigenère — the classic ciphers from the CTF zone.