How to use the URL & Payload Encoding Suite
One place to encode or decode the encoding formats you actually meet in API debugging: Base64, Base64URL, Hex, Gzip, Deflate, percent-encoding, HTML entities, and UTF-8 byte conversions. Chain encodings end-to-end — for example, Base64URL → Gzip → JSON — to peel apart compressed tokens, layered query parameters, and packed payloads. Everything runs locally; payloads never leave your browser.
What it does
- Base64 and Base64URL (RFC 4648, with and without padding).
- Hex encoding (with optional
0x prefix, byte separators, ASCII pair, hexdump variants).
- Gzip and Deflate compression / decompression (browser-native).
- Percent-encoding (URL encoding) and HTML entity encoding/decoding.
- UTF-8 byte view to inspect non-ASCII characters.
- Chained pipeline: apply multiple encode/decode steps in order to peel apart layered payloads.
When to use it
- Decode a compressed token or compressed cookie value (often Base64 + Gzip).
- Inspect a hex dump from a packet capture or binary log.
- Investigate a multi-encoded query string (URL-encoded → Base64URL → JSON).
- Reproduce how a client encodes a request body for replay tests.
- Decode HTML entities from a scraped page to read the original text.
- Convert between Base64 and Base64URL when integrating two systems that use different variants.
How to use it
- Pick an encoding type from the list (Base64, Base64URL, Hex, Gzip, Deflate, percent-encoding, HTML entities).
- Paste your input.
- Click Encode or Decode; the result appears instantly.
- To handle layered payloads, add another step to the pipeline (e.g., Base64URL decode → Gzip decompress → format as JSON).
- Send the final clean output to the JSON Formatter, JWT Decoder, or wherever it makes sense.
Tips & pitfalls
- If Base64 fails to decode, check padding (
=) and which variant is used — standard vs URL-safe.
- Gzip-decoding non-gzip data throws an error — confirm the magic bytes first when in doubt (Gzip starts with
1f 8b).
- Percent-decode before Base64-decoding when a URL parameter wraps a Base64 value.
- Hex with separators (spaces, colons,
0x prefixes) is supported — the tool normalizes the input.
- For raw
deflate (without zlib header), pick the raw deflate variant — picking zlib instead will fail on raw streams.
FAQ
- What is the difference between Base64 and Base64URL? Base64URL uses
- and _ in place of + and /, and padding is optional. Used by JWTs, OAuth, and URL-safe contexts.
- How do I decode a Gzip-encoded payload in the browser? Pick Gzip in the suite and paste either the raw bytes (hex) or the Base64-encoded payload chained with a Base64 decode step.
- What is the difference between Gzip and Deflate? Gzip wraps Deflate-compressed data in a header + checksum. Some APIs use raw Deflate; others use zlib-wrapped Deflate.
- Are my payloads uploaded? No. All encoding, decoding, and compression run in your browser.
- Can I chain multiple encodings? Yes — the suite supports a pipeline of steps so you can decode a layered payload in one place.
- What is the difference between HTML entities and URL encoding? HTML entity encoding (
&) escapes for HTML context; URL encoding (%26) escapes for URLs. They are not interchangeable.
Runs locally in your browser. No uploads. Share links use an encrypted URL fragment — nothing is sent to a server.
