Encoding bugs are almost always an argument about which layer already did the escaping. These tools show the bytes rather than assuming, so you can see whether a string is double-encoded, whether the hex is UTF-8 or Latin-1, and exactly which character broke the payload.
0x
Text & bytes
Decode byte strings and transform text encodings without uploading the source.
Base64 and hexadecimal are reversible representations with no key and no secret. Anything encoded is readable by anyone who can be bothered to decode it, which is why a Base64 blob in a URL or a JWT payload is not private. JWTs in particular are signed, not encrypted — the decoder here shows the header and claims precisely because anyone holding the token can already read them.
The double-encoding trap
Percent-encoding a string that is already percent-encoded turns %20 into %2520, and the symptom is a literal %20 appearing in the final output. The rule is to encode exactly once, at the boundary where the value is placed into a URL, and to encode components rather than whole URLs — encoding a full URL destroys the :// and the ? that give it structure.
Hex, ASCII, and UTF-8
A hex dump only becomes text once you decide the encoding. Strict ASCII covers 0–127 and rejects anything above it, which is the honest behaviour when the bytes are not text at all. UTF-8 validates multi-byte sequences and reports where a sequence is malformed rather than silently substituting a replacement character. If a decode produces mojibake, the encoding assumption is wrong — not the bytes.