Identify the representation
Base64 represents bytes with a text alphabet. URL percent encoding represents selected bytes using a percent sign and two hexadecimal digits.
Neither format encrypts the data. Decode only the format expected by the source system; appearance alone does not prove a value's format.
- SGVsbG8= decodes from standard Base64 to Hello.
- Hello%20world decodes from percent encoding to Hello world.
- A decoded result can contain binary bytes instead of readable text.
Check a Base64 example byte for byte
Enter Hello with no final line break. The standard Base64 result is SGVsbG8=. Decode it to recover the five original characters.
Hello followed by a line feed encodes as SGVsbG8K. The extra byte changes the result, even when the visible words look identical.
Match the source alphabet and padding rules. Standard Base64 and URL-safe Base64 use different characters for two alphabet positions.
Encode one query value
A query value containing red&blue needs to preserve the ampersand as data. Its percent-encoded form is red%26blue.
Use the setting that encodes special characters for an individual value. Encoding a full address has different requirements for separators.
Avoid encoding twice. Encoding the percent sign in %26 produces %2526, which changes what one decoding pass returns.
Reverse combined encoding in the right order
Suppose a query contains SGVsbG8%3D. URL decoding returns SGVsbG8=. Base64 decoding then returns Hello.
Follow the reverse order of the original transformations. If the result differs, check the alphabet, plus-sign handling, and final line breaks.
Do not remove whitespace from the decoded text unless the task requires it. Spaces can carry meaning and cannot be restored automatically.
Keep encoded secrets private
An encoded token remains sensitive. Anyone with access to it can decode an ordinary Base64 or percent-encoded value.
Do not put secrets in shared URLs. Inspect the result and the receiving application's requirements before sending encoded data.