Why another set of developer tools
There is no shortage of places to paste a Base64 string. What is genuinely scarce is a tool that also tells you why the output is a third longer than the input, when the URL-safe alphabet matters, and why your decoded text has mangled accented characters.
Most utility sites treat the tool as the whole product. You arrive from a search, paste, copy, leave. That works, and it also means the same person returns next month with the same confusion, because nothing on the page addressed it. The tools here are paired with genuine explanation: the encoding table, the timezone trap, the two's complement edge case, the difference between a network address and a usable host.
Everything runs client-side. Nothing you paste is transmitted, logged or stored, and there is no server-side processing on this site at all. For developer tools that matters concretely, because the strings people paste are routinely credentials, internal hostnames, tokens and customer data.
The five tools
| If you need to… | Use |
|---|---|
| Embed binary data in JSON, a data URI or an email header | Base64 Encoder & Decoder |
| Read a timestamp out of a log file or database column | Unix Timestamp Converter |
| Read a hex colour, a permission mask or a bit flag | Number Base Converter |
| Turn article titles into clean URLs | Slug Generator |
| Work out what fits in a /26 and where it starts | CIDR Subnet Calculator |
Four things worth knowing before you paste
Base64 is encoding, not encryption
This confusion causes real security incidents. Base64 is a reversible mapping designed to move binary data through text-only channels. It provides no confidentiality whatsoever — anyone can decode it instantly, and every tool on this page will do it in one click. A password stored Base64-encoded is a password stored in plaintext with an extra step.
The reason it exists is historical and still relevant: email headers, HTTP headers, JSON string fields and URLs are all text channels that mangle arbitrary bytes. Base64 maps every three bytes onto four printable ASCII characters, which is why encoded output is always about 33% larger than what went in.
Unix timestamps have no timezone
An epoch value is a count of seconds since 1 January 1970 UTC. It is an absolute instant, identical everywhere on Earth. Timezone only enters when you format it for a human, and that is where the bugs live — a timestamp displayed in the server's local zone, stored back, and displayed again elsewhere drifts by hours.
The second recurring trap is units. Unix time is conventionally seconds; JavaScript's Date.now() returns milliseconds; some systems use microseconds. A ten-digit number is almost certainly seconds, thirteen digits almost certainly milliseconds. Feed one into a parser expecting the other and you land in 1970 or in the year 55,000.
Bases are notation, not different numbers
The value 255, 0xFF and 0b11111111 are the same quantity written three ways. Nothing about the number changes; only the symbols used to write it down. Hexadecimal earned its place because one hex digit maps exactly onto four bits, so a byte is always precisely two hex characters — which is why colours, memory addresses and hashes are all written in hex.
A /24 does not give you 256 usable addresses
Two addresses in every ordinary IPv4 subnet are reserved: the first is the network identifier and the last is the broadcast address. Neither can be assigned to a host. A /24 has 256 total addresses and 254 usable ones. The exceptions are /31, used for point-to-point links where both addresses are usable, and /32, a single host route.
How these tools are built
- Client-side only. Plain JavaScript on the page you already loaded. No network requests, no logging, no storage.
- Explained, not just executed. Every page documents the mechanism, works an example with real values, and lists the edge cases that break it.
- Honest about limits. Where a tool cannot do something — verify a JWT signature, handle IPv6, guess a character encoding — it says so rather than failing quietly.
- No dependencies. Each page is one self-contained file. No frameworks, no external fonts, no third-party scripts.
- Unicode-correct. Text handling uses proper UTF-8 conversion rather than the naive btoa path that throws on any character above U+00FF.
Frequently asked questions
Is anything I paste sent to a server?
Can I use these on confidential data?
Why do accented characters break in other Base64 tools?
Will you add more tools?
Can I use these commercially?
Choosing between encodings
Three transformations get confused with one another constantly, because all three turn text into other text and all three are reversible. They solve different problems and are not interchangeable.
| Transformation | Purpose | Example | Size change |
|---|---|---|---|
| Base64 | Move arbitrary binary through a text channel | Man → TWFu | +33% |
| Percent-encoding | Escape reserved characters within a URL | a b → a%20b | Varies |
| HTML entities | Escape characters with meaning in markup | < → < | Varies |
The rule of thumb: Base64 when the input is binary and the channel is text. Percent-encoding when the input is text and the channel is a URL. HTML entities when the input is text and the channel is markup. Applying the wrong one produces output that looks plausible and breaks in a way that is tedious to trace — Base64-encoding a URL parameter, for instance, works right up until the encoded string happens to contain a + or /.
A related trap is double-encoding. Encoding something twice is silent and reversible only if you decode exactly twice, which is why %2520 shows up in broken links: a space became %20, then the % itself became %25. If a string looks nearly right but has stray percent signs or trailing equals, suspect double-encoding before anything else.
A note on trusting browser tools
You should not take our word for the client-side claim, and you do not have to. Open your browser's developer tools, switch to the Network tab, and use any tool on this site. Nothing fires — no XHR, no fetch, no beacon, not even when you select a file for the Base64 encoder. The page makes exactly one request, for itself, and then operates entirely locally.
That is worth checking on any utility site handling data you care about, not just this one. Plenty of tools that look identical do post your input to a server, sometimes to a third-party API, and the only way to know is to look.