Encode & Decode

Base64 and URL encoding both ways, Basic Auth headers, JWT decoding and HMAC signatures — the small conversions API steps keep asking for.

Text

Base64

Text

Encoded

Make a header

Username or API key Password or secret

Header

Value

Base64 only

Read a header

Authorization header or its Base64

Username

Password

Token

Empty

Check the signature

Not checked

Secret The secret is Base64-encoded

Header

Payload

Times and claims

Message

Signature

SHA-256 hash

Algorithm Key is

Secret key — leave empty for a plain hash

Hex

Base64

Compare with a signature you received

Questions

Does Base64 handle emoji and other languages?

Yes. Text is encoded as UTF-8 first, so ₹, é and emoji come back exactly. You can also open a file to get its Base64, and decoded binary data can be downloaded as a file.

What is URL-safe Base64?

A variant that uses - and _ instead of + and /, usually without = padding, so it can sit in a URL or a JWT. Decoding accepts both kinds.

When do I need a Basic Auth header?

When an API asks for Authorization: Basic followed by the Base64 of username:password. API by Pabbly can do this for you with its Basic Auth option; the header is for apps and code steps that need it written out.

Is anything I paste sent to a server?

No. Every conversion runs in your browser, so tokens, passwords and secrets never leave your computer, and none of them are saved.

Encode & Decode

Text

Base64

Text

Encoded

URL parts

Make a header

Read a header

Token

Check the signature

Header

Payload

Times and claims

Message

Signature

How to use the Encode & Decode

Questions