Text encoder/decoder guide — Base64 & URL | Itqan

A redirect URL full of %D9%85 byte pairs, a log line with eyJhbGciOiJIUzI1NiJ9, or a form field that turned spaces into plus signs — encoded text is everyday web work, and you usually need the plain version in seconds. The text encoder/decoder on Itqan runs four conversions from one input field: Base64 encode, Base64 decode, URL encode, and URL decode. Results refresh as you type; nothing is uploaded for the conversion itself. This guide is written specifically for that tool — how its panels behave, when each encoding applies, and workflows that save copy-paste loops. It does not cover HTML entity escaping; that is a separate markup layer this page deliberately omits.

Encoded text in the wild

HTTP limits which characters ride unchanged in URLs; APIs and email impose the same rule on JSON and MIME. Base64 moves arbitrary bytes through text channels; percent-encoding keeps reserved characters inside links without breaking parsers. Opaque strings are normal transport — friction appears when you must inspect, patch, or rebuild a value. Itqan’s encoder keeps that round trip in the tab you already have open, without uploading the payload.

One input, four mirrors

Open the text encoder/decoder. The layout is deliberate: one multiline input at the top, four result cards below. As soon as characters appear in the input, all four panels update — there is no separate “Convert” click.

1. Base64 encode — turns your plain text into the A–Z, a–z, 0–9, +, / alphabet (with = padding when needed). The implementation uses btoa over UTF-8 via encodeURIComponent, so Arabic and emoji survive the round trip.
2. Base64 decode — assumes the input is Base64 and shows the recovered plain text, or an error if the string is invalid.
3. URL encode — runs encodeURIComponent semantics: reserved characters become %XX hex pairs; spaces become %20 (not +, which is form-style).
4. URL decode — reverses percent-encoding when the input is an encoded fragment.

Each card has its own Copy button. Decode cards also expose Apply, which writes the decoded value back into the input so you can continue working without manual select-all-paste. Toolbar actions above the input: load a built-in Sample, Clear the field, or Copy the current input text.

Base64 or percent-encoding?

If you are unsure, paste once and read all four panels: the decode result that produces sensible language (or valid JSON) tells you which encoding was used. For number-base work — binary, hex, octal — use the number base converter instead; it solves a different problem.

Reversible is not confidential

Base64 and URL encoding are deterministic transforms anyone can undo in one browser-console line. Wrapping an API key in Base64 or tucking a password behind percent signs changes appearance only — not secrecy. Itqan processes locally, so payloads stay off our servers, but shoulder surfing and compromised extensions on shared laptops remain real risks. Rotate credentials that ever lived in tickets or screenshots; use secret managers and encryption at rest for actual confidentiality.

Walkthrough: JWT header segment

JWTs are three dot-separated segments; the first two are Base64URL JSON. Copy the header (before the first dot). If decode fails, swap -/_ for +//. Read Base64 decode for JSON like {"alg":"HS256","typ":"JWT"}; use Apply to edit in place. Inspection only — signature verification needs the issuer key.

Walkthrough: Arabic search text inside a copied link

A campaign URL might show q=%D8%A7%D8%AA%D9%82%D8%A7%D9%86 instead of readable Arabic. Paste the parameter, read URL decode, edit, copy from URL encode, or Apply after decode. Mojibake usually means double-encoding — see below.

Walkthrough: stacked percent signs in a redirect

Older gateways may encode twice — %2520 instead of a single space. Paste, read URL decode, Apply if percent signs remain, then re-encode once from URL encode. Nested Base64 follows the same Apply loop.

Walkthrough: Basic auth header from integration docs

Docs often show Authorization: Basic dXNlcjpwYXNz — the segment after Basic is Base64 of username:password, not encryption. Paste it, read Base64 decode for user:pass, or type myuser:mypassword and copy Base64 encode for a test header. Use throwaway accounts on shared machines.

Walkthrough: snippet from a data URI

For data:text/plain;base64,SGVsbG8=, paste the block after the comma and decode to Hello. Image payloads decode to non-readable bytes — this tool inspects text snippets, not full binary files.

Chaining with Apply

Apply on a decode card replaces the input and refreshes all four panels. Chain: garbled callback → Apply after URL decode → fix typo → copy URL encode into your test client. An error alert means invalid input for that decode type — try the other panel or fix Base64 padding.

Rolling action log

Last ten actions (copies, applies) with timestamps live in localStorage under encoderHistory. Clear before handing off a shared laptop if the log might hold client names or decoded tokens.

Browser-only processing

All four conversions run in JavaScript in your tab — no POST of input to Itqan servers. Clear the field and history on shared machines; local processing does not make an untrusted PC safe for live credentials.

Honest limits

• Text in, text out — no drag-and-drop for large binary files; paste short strings or moderate log excerpts.
• Base64 and URL only — no HTML entity encoder (<, &). Escaping markup for templates is a different context; URL %3C is not interchangeable with < in HTML source.
• Invalid Base64 shows an error in the decode panel — check missing = padding, stray whitespace, or non-Base64 characters.
• JWT Base64URL may need character substitution before decode, as noted in the JWT walkthrough.
• Form application/x-www-form-urlencoded sometimes uses + for spaces; this tool’s URL encode uses %20. Convert plus signs manually when debugging legacy form posts.

Mistakes that look like bugs

Treating Base64 as a vault

Scanners and interns decode it at the same speed you do. Rotate any secret that was stored “Base64 only.”

Swapping URL escape for HTML escape

Putting %3Cscript%3E in an HTML attribute does not replace proper HTML escaping — and vice versa. Match the encoding layer to the layer you are fixing.

Decoding the whole URL when only a parameter was encoded

The path may be plain while the query value is percent-encoded. Decode the parameter value, not the entire URL with scheme and host, unless you know the whole string was encoded as one unit.

Assuming UTF-8 everywhere

URL decode here uses decodeURIComponent with UTF-8 semantics. Legacy ISO-8859-1 pages can produce surprising bytes for Arabic or Latin accented characters.

Wrapped Base64 from email

Line breaks from MIME wrapping can break decode. Trim or join lines before pasting.

Short answers

Pair with other tools

• Number base converter — binary, octal, decimal, hexadecimal
• JSON editor — format and validate after you decode a Base64 JSON blob
• Case converter — normalize text before encoding
• Word counter — measure length of decoded content

Everyday encoding workflows that stay safe

Encoding is not encryption. Base64, URL encoding, and HTML entity encoding make data travel safely through channels that dislike spaces, Arabic letters, or angle brackets — they do not hide secrets from someone who can decode. Use the encoder/decoder when you paste a query string, embed Arabic text in a JSON snippet, or diagnose why a form field arrives mangled. Pair it with the JSON editor when the payload must stay valid JSON after you tweak strings, and with the case converter when you need to normalize casing before encoding.

Typical loop: copy the broken value from a browser address bar → URL-decode → read the Arabic or English clearly → fix typos → URL-encode again → paste back. For HTML email templates, encode only the fragments that break markup; leave readable prose alone so editors can still proofread. Never paste live API keys into public machines — decode privately, then clear the field. If you also need length checks on the decoded text, open the word counter in a second tab.