Decoding Base64, URL and other encoded text, and escaping it

Two sides of one problem. A log line, a tracking link or a config file holds something like H4sIAAAA… or %257B%2522id, and you need to know what it says. Or you need to put text containing quotes, spaces or & into JSON, a terminal command or a URL, and it keeps coming out mangled. These tools do both in your browser; nothing you paste is sent anywhere.

1. Ask what it is

Paste the string into Identify. It guesses from its shape and by trying to decode it, most likely first, and shows what each guess Reads as; Base64 holding compressed data shows as Base64: gzip and the like. A few clues are worth knowing yourself:

• Letters, digits, +, / and = at the end: Base64. With - and _ instead, URL-safe Base64, as in tokens.
• % followed by two hex digits: percent-encoding from a URL. %25 means it was encoded twice.
• Base64 starting H4sI: gzip-compressed data. Starting eJ: zlib.
• Three parts separated by dots, the first starting eyJ: a JSON Web Token.

Follow its link to the tool that decodes it.

2. Peel off one layer at a time

Encoded data is often wrapped several times, such as JSON, then gzip, then Base64, then percent-encoded in a link. Undo the outermost layer, then identify the result again:

• Percent-encoding: URL Encode / Decode, Decode. Tick When decoding, read + as a space for form data. For a whole link, the URL Inspector splits it into its parts and decodes each query parameter, and Unwrap takes the real address out of a tracking or safe-links wrapper.
• Base64 and its relatives: Text ⇄ Base64, Decode, with Encoding set to Base64, Base32, Base58 and so on. Use as input puts the result back in the box for the next round.

• gzip, zlib or deflate: Compress / Decompress with The input is set to Base64 and Decompress; the format is detected.

• Binary data from a program: when Base64 or hex decodes to bytes that aren’t text, a gRPC message, a mobile app’s cookie or a device’s payload may be Protobuf, CBOR or MessagePack. Paste it into the Binary Data Decoder, which tries each and shows the fields and values without needing a schema.

When the result is readable JSON, Open in… JSON Format lays it out.

3. Escape text for where it’s going

Each place text goes has characters that mean something there, and those must be escaped to be taken literally. Paste the text into the String Escaper, choose As and Escape:

• JSON or JavaScript string: quotes become \", line breaks \n, so a value with quotes doesn’t break the JSON around it.
• Shell (zsh, bash) single-quoted: the safe way to put any text, $ and ! included, in a terminal command.
• HTML or XML text: <, > and & become entities, so user text can’t turn into markup.
• Regular expression (literal match): ., (, ? and the rest are escaped, to search for text as it is.

Unescape goes back the other way, for text copied out of JSON or a log.

4. Put values into a URL correctly

A value going into a URL needs Aggressive encoding in URL Encode / Decode, so &, = and / in it can’t be read as the URL’s own punctuation; a whole URL needs Typical, which leaves its structure alone. Easier still: build it in the URL Inspector, where you type names and values with Add parameter and the Rebuilt URL is encoded for you.

When it’s a token or a whole file

A JSON Web Token has its own guide, What’s inside this JWT?; a whole file of unknown bytes is covered by What is this file?. Real tokens and cookies are secrets: decode them here rather than on a site that uploads them.