How Decode This works
- Paste the string into the input box exactly as you found it. Log lines, query strings, email bodies and message contents all work.
- Press Decode this. If the value contains percent escapes such as
%20or%E4, the URL decoder runs first; otherwise the Base64 decoder runs. - Read the result and the status line. It says which decoder succeeded — “Decoded as Base64” or “Decoded as percent-encoded URL text” — so you know what the string was, not just what it says.
- If neither decoder can read the string, the message explains what it looks like and what to try next, instead of quietly returning the input unchanged.
What you can paste here
- Base64 from logs, API dumps, email headers or configuration files, including URL-safe variants and values with line breaks.
- Percent-encoded query strings and path segments, such as
?q=hello%20world&lang=zh, including full URLs pasted with their escapes. - JWT header or payload segments, which are Base64URL and usually decode to JSON.
- data: URLs and values with a surrounding prefix, because the prefix is stripped before Base64 decoding.
- Short mystery strings from chat messages or documentation, where the point is to find out what encoding was used at all.
A field guide to common encoded strings
| Looks like | Likely format | What it says |
|---|---|---|
SGVsbG8sIHdvcmxkIQ== | Base64 | Hello, world! |
Hello%2C%20world%21 | Percent-encoded URL text | Hello, world! |
5L2g5aW9 | Base64 of UTF-8 | 你好 — Chinese for hello |
%E4%BD%A0%E5%A5%BD | Percent-encoded UTF-8 | 你好, the same two characters |
eyJhbGciOiJIUzI1NiJ9 | Base64URL | The JSON header of a JWT |
48656c6c6f | Hex (not supported here) | Hello in hexadecimal — use a hex decoder |
The table is a guide, not a set of rules. Base64 has no fixed prefix and short strings can look plausible in both alphabets, which is why the tool tries the formats and reports what actually worked. The status line always names the decoder that produced the output.
When Decode This cannot decode something
Two encodings cover most of the strings people ask about, but not all of them. A hex dump such as 48656c6c6f is not Base64, an HTML entity such as & is not URL encoding, and ROT13 is a cipher rather than an encoding. Encrypted values, hashes and compressed blobs are not reversible by design; no decoder can read them without a key or a decompression step.
Strings in non-UTF-8 character sets are another limit. Percent escapes store bytes, so a URL-encoded value from a legacy GBK page can be valid percent-encoding whose bytes are not valid UTF-8. This tool reports an error for those instead of guessing a character set. When you know the source is UTF-8, decoding is exact.
Decode safely
Decoding is not the same as trusting. A decoded string can contain a link that redirects somewhere unexpected, a script payload, or a message crafted to look like an instruction from your system. Read the output; do not execute it.
Also be careful with secrets. Although this tool decodes locally and sends nothing, a password or access token pasted into any browser page can leak through a malicious extension or a screen share. When a value is sensitive, prefer a command-line decoder on the machine that owns it, and revoke anything you pasted somewhere you do not control.
Frequently asked questions
How does Decode This decide between Base64 and URL encoding?
It looks for percent escapes first, because they are an unambiguous signal: a value containing %20 or %E4 is almost certainly percent-encoded. Without percent escapes, the string is tried as Base64. Both decoders validate their input strictly, so a string that merely contains letters is not silently treated as text.
Can it decode hex, HTML entities or ROT13?
No. This page covers Base64 and percent-encoding only. For hex, HTML entities or ROT13 you need a different tool, and guessing would be worse than declining: the page tells you it could not recognise the string instead of showing a plausible but wrong result.
Why does the decoded URL still contain strange characters?
The value was probably encoded twice. Percent-encoding turns a space into %20; encoding that result again turns the percent sign into %25, producing %2520. Decoding once gives %20 and decoding twice gives a space. Paste the result back into the input and press Decode this again.
Is it safe to paste a password or token?
No website is the right place for a live secret. This tool sends nothing, but a browser extension, clipboard manager or screen recording can still expose what you paste. Decode sensitive values on the machine that owns them, and rotate anything that may have leaked.
Does Decode This encode too?
Yes, the Encode to Base64 button encodes the current text to Base64. For percent-encoding there is a dedicated URL Encode page, and the Base64 Decode page gives the same detector-free decoder without the automatic format check.