Encode & Decode: Base64, URL, HTML & JWT

Encode or decode Base64 and URL-encoded text locally. Premium adds HTML entities, JWT decode, hex/binary view, batch, and history.

Base64 encode/decode, URL/percent-encoding, HTML entity encode/decode, and JWT decode — one popup, paste-based, nothing installed on any page A developer has a Base64 blob, a percent-encoded URL, HTML entities in scraped markup, or a JWT from an auth header, and needs to see what it actually says — or needs to encode something to paste somewhere. This extension does all four reversible transforms in one clean popup, entirely on your device. PRIVATE BY DESIGN The text you paste — which may be a token, a credential, or scraped private data — never leaves your browser. This is a paste-mode popup: it never reads the active tab or any page content, requests no host permissions, and injects no scripts. Every transform runs locally, in first-party bundled code (no CDN, no remote code, no eval). This extension collects no data of any kind — no analytics, no tracking, no telemetry, and no account is ever required to use the free features. The only network traffic it ever makes is a purchase-verification check with ExtensionPay if you choose to upgrade. WHAT IT DOES (FREE) - BASE64 — encode or decode, standard or URL-safe alphabet. Standard-alphabet padding is yours to turn on or off; URL-safe output is always unpadded, because '=' is a reserved character that has to be percent-encoded (%3D) in a URL, and RFC 7515 base64url is defined without it. Handles the full range of real-world input: multi-byte UTF-8 text (CJK, accented characters, emoji), whitespace-wrapped/PEM-style blobs, and gives an honest error — never a silently garbled result — on malformed input. - URL / PERCENT-ENCODING — three explicit, clearly-labeled modes: Component (a single value, %20 for space), Full URI (an entire URL, reserved characters like / ? # kept), and Form (application/x-www-form-urlencoded, where + means space). The mode is always stated, never guessed — the exact same '+' character means a literal plus in a path and a space in a form value, and this tool never blurs that distinction. - AUTO-DETECT SUGGESTION — pastes that look like Base64, a percent-encoded URL, or HTML entities get a "looks like X — use it?" suggestion. It is always a suggestion you can dismiss, never a silent switch. - COPY and SWAP — one-click copy of the result, or swap it back into the input to chain another transform. PREMIUM ($5 one-time) - HTML ENTITY ENCODE/DECODE — named (&, ©, € and the rest of the HTML4/XHTML1 named-character-reference set), decimal, and hex numeric references. Decoded output is always plain text, never rendered as markup. - JWT DECODE — pretty-printed header and payload, with the alg claim clearly labeled as a claim the token makes about itself (attacker-controlled — alg:"none" is flagged explicitly). This is decode and inspect ONLY: this extension has no key and makes no network call, so it can never verify a signature, and it never implies or displays that a token is valid, authentic, or trustworthy. There is no checkmark, no "verified" badge — ever. - HEX / BINARY BYTE VIEW — see the exact bytes behind a Base64 result. - FILE → DATA URI — pick a file and turn it into a data: URI. - BATCH — run the current transform over many lines at once. - SAVED HISTORY — a local log of past conversions, stored only on your device. Saving a JWT stores the decoded header and payload ONLY — the raw token and its signature are never written to storage, because a JWT is a credential. HOW TO USE 1. Pick a family (Base64, URL, or — with premium — HTML entities or JWT). 2. Paste text, choose Encode or Decode, and read the result live. 3. Copy the result, or swap it back into the input to chain another transform. ENCODING IS NOT ENCRYPTION, AND NOT HASHING Base64 and URL-encoding are REVERSIBLE representations of data, not security measures — anyone can decode them, instantly, with no key. This extension never implies otherwise. It is also a different job from a one-way hash or checksum tool: encoding here always has an inverse; a hash never does. HONEST ABOUT JWT — THE PART THAT MATTERS MOST A JWT's signature can only be checked with the issuing service's secret or public key. This extension never has that key and makes no network request, so it CANNOT and DOES NOT verify a signature. It decodes and displays the header and payload so you can read the claims, and nothing more — never a validity verdict, never a trust signal. No subscription — pay once and keep the features. No account is needed to install or use the extension. Premium checkout is handled by ExtensionPay, which keys your licence to the email address you give it, so you can restore that licence on another device.