URL encoding and Base64 solve different transport problems. Percent-encoding preserves URI structure while representing bytes that are not allowed directly in a component. Base64 converts a byte sequence into text for systems that need a limited character set. Choosing by appearance rather than protocol is a common source of bugs.
Use the URL Encoder / Decoder for URI component values and the Base64 Encoder / Decoder for reversible Base64 representation. Both operate locally in the browser, alongside other focused workflows in the Utilities hub.
How URL Percent-Encoding Works
RFC 3986 defines percent-encoding as a percent sign followed by two hexadecimal digits representing an octet.
space -> %20
? -> %3F when represented as data rather than a delimiterReserved characters such as ?, &, / and # can define URI structure. Whether they should be encoded depends on the component. Encoding a query value is different from encoding a complete URL.
Original value: summer sale & clearance
Query value: summer%20sale%20%26%20clearanceIn browser JavaScript, encodeURIComponent is commonly used for an individual component value. encodeURI preserves more URI delimiters and is not interchangeable.
How Base64 Works
RFC 4648 defines Base64 as a representation of bytes using a 64-character alphabet, with = padding in the standard form where required.
Hello -> SGVsbG8=The encoded form is usually larger than the source bytes. Anyone with a decoder can reverse it, so do not use Base64 to conceal passwords, tokens or private data.
Standard and URL-Safe Base64
Standard Base64 uses + and /. Those characters can be inconvenient in some URL or filename contexts. RFC 4648 also defines a URL- and filename-safe alphabet that uses - and _ instead.
Padding rules depend on the protocol. Do not remove = or swap alphabets unless the receiving format permits it.
Side-by-Side Comparison
| Question | URL percent-encoding | Base64 |
|---|---|---|
| Main purpose | Represent data safely inside URI components | Represent arbitrary bytes as text |
| Typical marker | % plus hexadecimal digits |
Alphabet of letters, digits and symbols |
| Preserves URL structure | Yes, when applied to the correct component | Not by itself |
| Handles binary bytes | Indirectly and inefficiently | Designed for byte sequences |
| Reversible | Yes | Yes |
| Provides secrecy | No | No |
Unicode and Character Encoding
Text characters must be mapped to bytes before either encoding is meaningful. Modern web workflows commonly use UTF-8. If an encoder and decoder assume different character encodings, non-ASCII text can become corrupted even when the outer encoding is valid.
Test emoji, accented characters and non-Latin scripts when interoperability matters.
Common Mistakes
Encoding a full URL as a query value
If you percent-encode every delimiter, the URL stops behaving as the same structured address. Encode only the component you are inserting unless a protocol explicitly asks for the whole URL as data.
Double encoding
Encoding %20 again can produce %2520 because % itself becomes %25. Track whether a value is raw or already encoded.
Using Base64 as encryption
Base64 output may look opaque, but it provides no confidentiality. Use an established encryption system when secrecy is required.
Mixing Base64 variants
A decoder expecting standard Base64 may reject URL-safe characters, and padding expectations can differ.
Hashing when decoding is required
A hash is one-way and serves a different purpose. Use the Hash Generator for a digest, not for reversible storage.
Frequently asked questions
Should spaces in a URL become plus signs or `%20`?
RFC 3986 percent-encoding uses %20. A plus sign can represent a space in form-style query encoding, which is a related but distinct convention.
Can I put standard Base64 directly in a URL?
Only if the surrounding format handles its characters correctly. URL-safe Base64 is usually more suitable when the protocol specifies that variant.
Does decoding unknown Base64 make it safe?
No. Decoded content can still be sensitive or unsafe to execute. Treat it as untrusted data.
Which encoding should I use for a query parameter?
Percent-encode the parameter value according to the URL-building API or protocol. Use Base64 only when the protocol specifically expects Base64 data.
Let the Protocol Decide
Start with the receiving system's specification. Percent-encode URI components, use the required Base64 variant for byte representation and keep security controls separate from encoding. That avoids brittle transformations and false assumptions about privacy.