Base64, URL encoding and HTML entities: which one do you need?

By The HandyTechHelper team · 6 min read · Published November 2, 2026

All three of these turn text into different-looking text, so they are easy to mix up. Each one exists to get data safely through a specific place: a text-only channel, a URL, or an HTML page. None of them is encryption.

Base64: binary data through text-only channels

Base64 represents bytes using 64 safe characters (A–Z, a–z, 0–9, + and /), with = used as padding. Every 3 bytes become 4 characters, so output is about a third longer than the input. It is used for email attachments, data URLs and many APIs.

Hi! encodes to SGkh.
café encodes to Y2Fmw6k=. The é is two bytes in UTF-8, which is why the output needs padding.

Anyone can decode Base64 instantly, so never use it to hide a password or secret. Use the Base64 encoder and decoder for text, or Image to Base64 to turn a picture into a data URL.

URL encoding: special characters inside a link

Some characters have a job in a URL: / separates path segments, ? starts the query, & separates parameters and # starts the fragment. To put those characters inside a value, they are percent-encoded as a % sign followed by the byte in hexadecimal.

a b&c/d? as a single parameter value becomes a%20b%26c%2Fd%3F.
Without encoding, ?q=fish&chips would be read as two parameters, q=fish and an empty chips.

Encode each value, not the whole URL. Encoding a complete address also encodes its / and ?, so it no longer works as a link. The URL encoder and decoder encodes one component at a time for exactly this reason.

HTML entities: showing characters a browser would treat as code

In HTML, < starts a tag and & starts an entity. To display them as text, write them as entities: <, >, &, " and ' (or ').

<b>bold</b> becomes <b>bold</b>, which a browser shows as the literal text instead of making it bold.
Fish & chips becomes Fish & chips.

Escaping text this way before putting it into a page is also one of the basic defences against cross-site scripting. Use the HTML entity encoder for a quick conversion, or Text to HTML to wrap a whole block of text safely.

Which one do I need?

Choosing an encoding
You want to…	Use
Put an image or file into JSON, CSS or an email	Base64
Put a search term or name into a link	URL encoding, per value
Show code or user text on a web page	HTML entities
Keep something secret	None of these. Use real encryption.

Common mistakes

Double encoding: encoding text that is already encoded turns %20 into %2520. Decode once to check what you have.
Using + for spaces: + means a space only in form-style query strings. In other parts of a URL it is a literal plus sign; %20 is safe everywhere.
Treating Base64 as security: it is a disguise at most.

Tools for this guide

Base64 encoder and decoderEncode Unicode text or decode UTF-8 Base64.URL encoder and decoderEncode or decode a URL component.HTML entity encoder and decoderEncode or decode common HTML entities.Hash generatorCalculate a SHA-256, SHA-384 or SHA-512 text digest.

Sources

Written with AI assistance, then checked against how HandyTechHelper’s tools actually behave. Figures from other companies link to their source. Spotted a mistake? Tell us.