Encoders & Decoders
Encoding isn't encryption — it's how binary data and special characters survive being placed somewhere they'd otherwise break: inside a URL, a JSON string, an HTTP header, or an HTML attribute. These tools convert both ways, so you can inspect what an encoded value actually contains.
Use them to decode a JWT's payload while debugging auth, read a Base64 blob from an API response, percent-encode a query parameter correctly, or hash a file to verify a download. All processing is local — tokens and payloads you paste stay on your device.
9 encode tools
Base64 Encoder/Decoder
Encode or decode Base64 strings instantly
URL Encoder/Decoder
Encode and decode URLs and query parameters
JWT Decoder
Decode and inspect JWT tokens instantly
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes and HMACs
HTML Entity Encoder
Encode and decode HTML entities and special characters
Image to Base64
Convert images to Base64 data URIs for embedding
Base58 Encoder / Decoder
Encode or decode Base58 strings — the Bitcoin-style alphabet that skips ambiguous characters
Base32 Encoder / Decoder
Encode or decode RFC 4648 Base32 strings — the format behind TOTP secrets and DNSSEC
Base62 Encoder / Decoder
Encode or decode Base62 strings — the alphanumeric-only alphabet behind short URL slugs
Guides
🧾 How to Estimate Your LLM API Costs Before You Get the Bill
A practical walkthrough of how LLM API pricing actually works — tokens, input vs output cost, why a long system prompt costs more than you think — so you can estimate spend before you ship, not after.
🪱 The keyv / cacheable npm Supply Chain Attack: Am I Affected, and How Do I Fix It?
On August 4, 2026, a compromised maintainer account turned keyv, flat-cache, file-entry-cache and a dozen related packages — over 500 million weekly downloads combined — into a credential-stealing worm. Here's exactly how to check if you pulled a bad version and what to do next.
🔏 HMAC Webhook Signature Verification: The Two Bugs Everyone Hits
Stripe, GitHub, and Shopify all sign webhooks with HMAC-SHA256 — and almost everyone trips on the same two mistakes: verifying against the parsed body instead of the raw one, and comparing signatures with ==.
🔗 URIError: URI Malformed — JavaScript URL Parsing Fix
The 'URI malformed' error in JavaScript happens when decodeURIComponent() or decodeURI() receives a string with invalid percent-encoding. Learn the exact causes and safe decoding patterns.
🔑 SignatureVerificationException: Signature verification failed — JWT Fix Guide
JWT signature verification failures are almost always caused by key mismatches, algorithm mismatches, or encoding differences. Learn to diagnose and fix every case with step-by-step examples.
🔑 ClaimJwtException: JWT Claim Validation Failed — Timestamp and Expiry Fix Guide
JWT claim validation errors are almost always caused by milliseconds vs seconds confusion or clock skew between services. Learn to diagnose expired tokens, iat-in-the-future errors, and fix each case.