Encode and decode

What this is actually doing

Encoding changes how something is written down. It does not change what it means and it does not hide anything. Base64 of a password is still the password to anyone who knows to decode it, and Base64 is one command away on every machine you will ever touch. Treating encoding as protection is one of the most common mistakes in this whole area.

Each format exists for a specific reason. Base64 puts arbitrary bytes into text so they can travel through systems that only accept text, which is why it turns up in email attachments, data URLs and JWTs. Base64URL is the same thing with the two characters that mean something in a URL swapped out. Hex is twice as long but has no padding rules and is trivial to read. URL encoding makes a value safe to put in a query string. HTML entity encoding stops a browser reading your text as markup, which is the actual fix for cross-site scripting. Binary is there so you can see exactly what the machine holds.

ROT13 is included on purpose. It is a Caesar shift of thirteen, it is its own inverse, and it has never been anything but a way to hide a punchline. If you have seen it described as encryption, that description was wrong.

All of this is byte-accurate for text that is not ASCII. Type an accent or an emoji and the conversion goes through UTF-8 first, so it round-trips rather than producing the mojibake you get from tools that treat strings as latin-1.

Other utilities