Base64, URL Encoding & HTML Entities — Text Encoding 101
Encoding is the art of making text survive channels that were never built for it: sending binary through a text-only pipe, putting arbitrary characters into a URL, or displaying angle brackets on a page built out of angle brackets. Three encodings do almost all of this work in daily life — Base64, URL percent-encoding and HTML entities — and knowing which is which, and which direction you are going, is the difference between debugging in seconds and mangling data into permanent garbage.
Encoding is not encryption
First, the fence that must go up: encoding is not security. Base64 is trivially reversible by anyone — it is a translation, not a lock. Its purpose is compatibility, not secrecy. If you Base64 something to "hide" it, you have hidden it from exactly nobody. Encoding solves the problem "this channel cannot carry these characters"; encryption solves "these characters must stay secret". They compose well and substitute for each other never.
Base64 — binary through a text pipe
Email, JSON, XML and a hundred other protocols were designed around a safe alphabet of printable characters. Binary data — images, encrypted blobs, anything with byte values outside that alphabet — would be corrupted in transit. Base64 rewrites any byte sequence using just 64 safe characters (A–Z, a–z, 0–9, + and /): every 3 bytes become 4 characters, with = padding at the tail. The cost is size — about 33% inflation — and the benefit is survival through every text-safe channel ever built.
- Data URIs: inline images in CSS and HTML are Base64 payloads.
- JWTs: the three segments of a JSON Web Token are Base64-encoded JSON and signature.
- Email attachments: MIME wraps binary attachments in Base64, as it has since the 1990s.
- APIs: shipping binary alongside JSON payloads.
URL percent-encoding — making URLs legal
URLs reserve certain characters for structure: ? starts a query, & separates parameters, = assigns them, # marks a fragment, spaces are simply illegal. Percent-encoding rewrites reserved and non-ASCII characters as % + two hex digits for their byte values — a space becomes %20, an ampersand %26, the é in café becomes %C3%A9 (two bytes, because UTF-8 encodes it as two). The failure mode it prevents is structural: an unencoded & in a query value silently splits one parameter into two.
HTML entities — angle brackets on a page of angle brackets
HTML itself is made of the characters you sometimes need to display: if a page must literally show <script>, the browser would otherwise treat those characters as markup. Entities substitute safe stand-ins: < for <, > for >, & for &, and named entities like © and for characters without keyboard seats. Any tool that displays user-contributed code must entity-encode it first — the omission is precisely how HTML injection happens.
Using LND AI Text Encoding/Decoding
- Open the toolGo to namansoni.in/text-encoding-decoding — completely free, no sign-up, all conversion runs locally in your browser.
- Paste your textAny text — a string to encode for transit, a mangled payload to decode back to sense.
- Pick the encodingBase64, URL percent-encoding or HTML entities — encode to send, decode to read.
- Verify round-tripsEncode then decode and confirm you got back exactly what you started with — for Base64 especially, watch for silently-stripped whitespace.
- Copy the resultTake the encoded form into your email template, URL, or HTML.
Frequently asked questions
Is Base64 encoding secure?
No — Base64 is a translation for transport, not encryption for secrecy. Anyone can reverse it instantly; it has no key and was never designed to hide anything. Use it to carry binary data through text-safe channels (email attachments, JSON APIs, data URIs), and use real encryption when confidentiality is the goal.
Why does Base64 make files bigger?
Base64 maps every 3 bytes (24 bits) onto 4 text characters, because printable characters safely carry only 6 bits each. Four 6-bit groups per three 8-bit bytes is a 4:3 ratio — roughly 33% size inflation, plus occasional = padding at the end. The inflation is the price of guaranteed survival through text-only channels.
When do I need URL encoding?
Whenever text with reserved or non-ASCII characters goes into a URL: query values containing & = ? or spaces, emoji, non-Latin scripts, or an entire URL embedded inside another URL’s parameter. The classic bug is an unencoded & inside a query value silently splitting one parameter into two. Encode anything you do not control character-by-character.
What are HTML entities for?
Displaying characters that HTML itself uses for structure — < and > to literally show angle brackets, & for ampersands — plus characters without keyboard seats like © and . Any tool displaying user-contributed code must entity-encode it first; skipping that step is exactly how HTML injection vulnerabilities arise.
How do I decode Base64 text back to normal?
Paste it into namansoni.in/text-encoding-decoding and decode — completely free, running locally so nothing leaves your browser. If the result looks wrong, first suspect whitespace or line breaks that were added in transit and silently corrupted the payload before decoding.