Encoding is reversible on purpose
These are small text tools for people who already know why they need them. Base64 and URL encoding are reversible encodings. They do not hide a secret. JSON, XML, and CSV conversions are for payloads you can read, not for untrusted files you have not inspected.
Everything runs in the page. Do not paste production credentials into a browser tool out of habit, even a local one.
If you already know the job, start with JSON to XML or XML to JSON.
Every format on the site is listed from the homepage.
Do not paste secrets here
Open the tool that names your two formats and read what the download will contain before you delete the original. If a result does not match that description, tell us.
Encoding is supposed to be reversible
Base64 turns bytes into ASCII so they can sit inside JSON, XML, or email. URL encoding turns spaces and symbols into percent sequences so a query string stays intact. Anyone can reverse either one. That is the feature. It is not a password store and not encryption. Do not paste production tokens out of habit, even though the text stays in the browser.
JSON, XML, and CSV tools are for payloads you can read. A list of similar objects becomes rows. Nested lists of unknown length will not become one clean sheet. A simple XML dump is not your partner's invoice schema. Encode once. Encoding twice breaks the link or the padding. Check a sample before you paste the result into a live request.
Keep a known input beside the output. For Base64, encode the word test and confirm you can decode it back to test. For a URL, change one space and confirm it became %20 a single time. For JSON to CSV, look at a field that contains a comma. These checks take a minute and prevent a bad payload from reaching a live API. None of this hides a secret. If the payload is large, save it as a file and use the file tools rather than a paste box that is awkward to scroll. If the payload contains a token, rotate the token after the test. The browser kept the text in memory for the tab, and a shared computer keeps that risk even when our server never saw it.
A known sample before the real payload
Encode the word hello, decode it, and confirm you get hello back before you touch a customer export. That one check tells you the tool and your clipboard are behaving. Then run the real text once. If you encode twice, the decoder will show the first encoding, not the original, and an API will reject it. URL encoding has the same trap with percent signs that were already encoded.
JSON to CSV is a table problem, not a text problem. Look at one nested field before you import thousands of rows. XML from this page is a simple dump. If a partner sent a schema, compare element names to that schema before you call the file done. None of these tools encrypt. Treat the screen as visible to anyone who can see your display.
When you paste from a chat app, hidden characters can ride along. If a decode fails on text that looks fine, paste into a plain editor first, then copy from there into the tool. Smart quotes and line-break characters are a frequent cause. The tool is strict because the formats are strict. A second paste from the same chat will repeat the problem. Clean the text once, convert once, and compare a short prefix to the value you expected.