Encoding & Escaping
Escape, unescape and encode text and structured data — JSON string escaping, Base64 and character encoding, all running locally in your browser.
3 tools
Encoding and escaping are commonly used as synonyms and are not the same operation. Encoding represents data in a different alphabet — Base64 turns arbitrary bytes into ASCII so they can travel through a text-only channel, and percent-encoding replaces characters that are structural in a URL. Escaping makes data safe to embed inside a syntax that would otherwise read it as structure: HTML entities inside markup, backslashes inside a JSON string.
This space is reserved for a sponsor. Every tool on this site stays free and runs locally in your browser.
Query String to JSON
Convert a URL query string to JSON and back, preserving repeated keys as arrays and showing how plus signs and percent-encoding differ. Runs locally.
JSON Escape and Unescape
Escape text into a valid JSON string literal and unescape it back, and see why hand-writing escapes breaks on control characters. Runs locally.
Base64 in JSON
Encode and decode Base64 in the browser, including URL-safe Base64 and the payload section of a JWT. Runs locally; Base64 is encoding, not encryption.
About Encoding & Escaping
The practical consequence is that the right tool depends on the destination, not on the source. Text going into a query parameter needs URL encoding; the same text going into an HTML attribute needs entity escaping; the same text going into a JSON string needs JSON escaping, applied exactly once. Applying two of them in sequence is the classic double-encoding bug, and it is what produces %2520 where a space was meant and & where an ampersand was.
Everything here runs locally, which matters because the strings involved are frequently credentials: tokens in query strings, signed URLs, connection strings from configuration files. Nothing is transmitted, and the tools work with the network disconnected.
Frequently asked questions
Do I need to encode or to decode?
Decode when text arrives in a form you cannot read: %20 where a space should be, & where an ampersand should be, or an opaque Base64 block. Encode when you are constructing a URL, embedding a value in markup, or handing a value to a system that will parse it against a grammar. If a string looks wrong but is technically decodable — %2520, for instance — do not decode twice to make it look right. Find the layer that encoded it a second time, because decoding only hides a bug that will reappear on the next write.
What is the difference between %20 and + in a URL?
Both can represent a space, but in different contexts. %20 is the percent-encoding of a space and is valid anywhere in a path or query. The plus sign meaning space is a convention from HTML form submission with application/x-www-form-urlencoded; outside that context a plus is a literal plus. This is why an encoded phone number arrives with spaces where it had plus signs. When constructing a URL by hand, encode a space as %20 and a literal plus as %2B.
Is Base64 encryption?
No, and treating it as though it were is a genuine security failure. Base64 is a reversible encoding with no key: anyone can decode it, and its alphabet is chosen so the output survives channels that mangle non-ASCII bytes. It provides no confidentiality whatsoever. It is the right tool for embedding binary data in text, for data URLs, and for transport through text-only systems. For confidentiality use TLS in transit and an authenticated cipher at rest.
Why did my text turn into mojibake like é?
That specific pattern is UTF-8 bytes being displayed as Latin-1 (Windows-1252). The character é is two bytes in UTF-8 (0xC3 0xA9) but one byte in Latin-1 (0xE9), so a reader that decodes the two UTF-8 bytes separately produces é. The cause is a mismatch between the encoding declared by the producer and the one assumed by the consumer, most often a missing charset in an HTTP header or a meta tag. The fix is to decode as UTF-8, not to retype the text — the bytes are intact and only the interpretation is wrong.
When should I escape HTML?
Whenever text that came from somewhere else is going to be inserted into markup, and it should happen at the point of output rather than on the way in. Escaping the five significant characters — ampersand, less-than, greater-than, double quote and single quote — prevents the value from being parsed as a tag or from breaking out of an attribute. Storing already-escaped text in a database is the mistake to avoid, because it double-escapes on the next read and makes the original value unrecoverable without guesswork.
Related categories
JSON Tools
Format, validate, compare and convert JSON, YAML, XML, CSV and TOML — every operation runs locally in your browser.
Text Tools
Word and character counting, manuscript fee estimates and other text utilities that run entirely in your browser.
Security Tools
Create strong, random passwords and other security helpers — every step runs locally in your browser, nothing is uploaded.
This space is reserved for a sponsor. Every tool on this site stays free and runs locally in your browser.