URL & Payload Encoding Suite
One place to encode or decode Base64, Base64URL, Hex, Gzip, Deflate, and percent-encoding. Leave it on Detect & decode and the tool identifies the encoding (including JWTs) and decodes it, or pick a format and direction. The Detection tab shows the identified encoding; Hexdump shows the raw bytes. Runs in your browser; nothing is uploaded.
Auto-runs as you type. Ctrl+Enter to re-run.
How to use the URL & Payload Encoding Suite
One place to encode or decode the formats you actually meet in API debugging: Base64, Base64URL, Hex, Gzip, Deflate, and percent-encoding. Leave the tool on Detect & decode to identify a compressed token, packed payload, or layered query parameter and decode it, or pick a format and direction explicitly. Everything runs locally; payloads never leave your browser.
What it does
- Base64 and Base64URL (RFC 4648, with and without padding).
- Hex encoding (accepts
0xprefixes and byte separators on decode). - Gzip and Deflate compression / decompression (browser-native, Base64-wrapped for text).
- Percent-encoding (URL encoding) and UTF-8 byte handling.
- Encoding auto-detection — identifies Base64, Base64URL, Hex, Percent, and JWTs.
- Hexdump view of the decoded or encoded bytes.
When to use it
- Decode a compressed token or cookie value (often Base64 + Gzip).
- Inspect a hex dump from a packet capture or binary log.
- Investigate a multi-encoded value (URL-encoded → Base64URL → JSON) one layer at a time.
- Reproduce how a client encodes a request body for replay tests.
- Convert between Base64 and Base64URL when integrating two systems that use different variants.
How to use it
- Paste your input.
- Leave Action on Detect & decode, or pick Encode / Decode and a format (Base64, Base64URL, Hex, Percent, Gzip, Deflate).
- The result appears instantly; open the Detection and Hexdump tabs for more.
- For a layered payload, decode one step, then paste the result back and decode the next layer.
- Send the final clean output to the JSON Formatter, JWT Decoder, or wherever it makes sense.
Tips & pitfalls
- If Base64 fails to decode, check padding (
=) and which variant is used — standard vs URL-safe. - Gzip-decoding non-gzip data throws an error — confirm the magic bytes first when in doubt (Gzip starts with
1f 8b). - Percent-decode before Base64-decoding when a URL parameter wraps a Base64 value.
- Hex with separators (spaces, colons,
0xprefixes) is supported — the tool normalizes the input on decode. - Gzip / Deflate output is Base64-wrapped so it stays copy-pasteable as text.
FAQ
- What is the difference between Base64 and Base64URL? Base64URL uses
-and_in place of+and/, and padding is optional. Used by JWTs, OAuth, and URL-safe contexts. - How do I decode a Gzip-encoded payload in the browser? Pick Gzip and paste the Base64-wrapped compressed payload; the suite decompresses it locally.
- What is the difference between Gzip and Deflate? Gzip wraps Deflate-compressed data in a header + checksum. Some APIs use raw Deflate; others use zlib-wrapped Deflate.
- Are my payloads uploaded? No. All encoding, decoding, and compression run in your browser.
- How does auto-detection work? The Detect & decode action inspects the input for percent escapes, hex, Base64 / Base64URL shape, and JWT structure, then decodes accordingly.