ForHosting KIT · Developer Utilities

Base16 RFC 4648 encoder & decoder

Encode text as RFC 4648 Base16, the standard uppercase hex where every byte becomes two characters: Hello turns into 48656C6C6F. Decoding accepts pasted dumps with spaces or colons and rejects anything malformed. Free in your browser.

Free
Runs in your browser
No sign-up
Your data stays on your device

Run — free How it works & API

Use it from WebAPIEmailTelegramApp soon

Worked example

If you enter

Text: Hello
Calculation mode: Encode

You get

Result: 48656C6C6F
Input: Hello
Base16: 48656C6C6F
Hex: 48656C6C6F

RFC 4648 Base16 is the standardized uppercase hexadecimal encoding: every input byte becomes exactly two characters from the alphabet 0-9 and A-F, with no padding and no ambiguous glyphs. This tool encodes plain UTF-8 text into that canonical Base16 form and decodes Base16 hex strings back to text, so you can paste either direction without installing a crypto library. Encoding always emits uppercase digits as the standard requires; decoding accepts common paste noise such as spaces, colons, and mixed case, then normalizes and validates before converting.

What RFC 4648 Base16 is and how the alphabet works

Base16 is defined in RFC 4648 as a binary-to-text encoding that maps each eight-bit octet onto two symbols from a sixteen-character alphabet: the decimal digits zero through nine followed by the uppercase Latin letters A through F. That alphabet is identical to the familiar uppercase hexadecimal notation used in protocol documents, packet traces, and many hardware manuals.

Encoding walks the input from left to right, splits each byte into a high nibble and a low nibble, and maps each nibble to one alphabet character, producing a string whose length is always twice the byte count. There is no padding character and no line-wrapping rule in the core encoding; consumers that need line breaks or separators add them for display only. Decoding reverses the map: every two consecutive hex digits become one byte.

Implementations that claim RFC 4648 compliance encode with uppercase A–F; many decoders also accept lowercase a–f for interoperability with tools that emit mixed case. Whitespace and decorative separators such as spaces, colons, underscores, or hyphens often appear in human-edited dumps and should be stripped before length and alphabet checks, then the remaining continuous string must have even length. When a character outside 0-9A-Fa-f appears, or when the digit count is odd, the decoder must fail loudly.

What you can do with it

Teaching RFC 4648 and hexadecimal notation

Classrooms encode Hello to 48656C6C6F, inspect the 0-9A-F alphabet, then force odd length or invalid characters to show strict validation.

FAQ

What alphabet does this Base16 encoder use?

The RFC 4648 Base16 alphabet: 0123456789ABCDEF. Encoding always produces uppercase A–F; decoding also accepts lowercase a–f and common separators.

Is Base16 the same as Base64?

No. Base16 maps each byte to two hex digits from a sixteen-symbol alphabet. Base64 uses sixty-four symbols, denser packing, and optional padding characters.

Does this convert large hex integers to decimal?

No. It treats the input as an opaque byte sequence under RFC 4648 Base16, not as a single multi-precision integer. Use number-format tools for hex-to-decimal of whole numbers.

Is the Base16 encoder free?

The browser tool is free and runs locally.

Can I decode hex that contains spaces, colons or lowercase letters?

Yes. Spaces, colons, underscores and hyphens are stripped and lowercase a to f is accepted, so a dump copied from a log or a packet trace decodes as is. What remains must be an even number of hex digits.

Related tools

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/enc/base16-rfc4648

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/enc/base16-rfc4648 \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text":"Hello"}'

const res = await fetch("https://api.kit.forhosting.com/enc/base16-rfc4648", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "text": "Hello"
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/enc/base16-rfc4648",
    headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
    json={
    "text": "Hello"
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/base16-rfc4648", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => '{"text":"Hello"}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"text":"Hello"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/base16-rfc4648", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "text": "Hello"
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "enc.base16_rfc4648",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Limits

max_chars 100000

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Technical notes

Malformed input—an odd number of hex digits, a non-alphabet character, or bytes that are not valid UTF-8—returns a clear invalid_input error instead of silent corruption.

How to call the API and what the response contains

The default mode is encode: UTF-8 bytes of text become an uppercase Base16 string under the RFC 4648 alphabet. Send a JSON body with a required string field text (aliases input, value, and data) and an optional mode that is either encode or decode. Mode decode treats text as a Base16 payload—optionally with spaces or colon separators and mixed case—and returns the recovered UTF-8 string after normalization. Input length is capped at one hundred thousand characters so a single request cannot exhaust Worker memory on pathological dumps. On success for encode, the response includes mode, input, result plus base16 and hex with the same encoded string, alphabet with the sixteen-character constant 0123456789ABCDEF, alphabet_name set to rfc4648_base16, standard set to RFC 4648 Base16, input_bytes as the UTF-8 byte count, output_length as the encoded character count, and a short English message. On success for decode, the response includes mode, input, result and text with the decoded UTF-8 string, base16_normalized with the uppercase continuous form, the same alphabet and standard fields, input_length, output_bytes, and a matching message. Failed validation—missing text, non-string text, oversize input, an unknown mode, an odd hex length, an invalid Base16 character, or decoded bytes that are not valid UTF-8—returns invalid_input and is never charged. Pricing is a flat $0.002 per successful request with unit item and zero marginal unit price.

Practical tips, limits, and how this differs from other encodings

Round-trip checks are the fastest smoke test: encode a known word such as Hello, confirm the classic uppercase result 48656C6C6F, then decode that string and confirm you recover the original phrase byte-for-byte. Prefer Base16 when you need a 1:1 nibble-visible dump that matches RFC 4648 and textbook hex; prefer Base64 when density matters more than readability. When teaching, show the same sentence encoded under Base16 and Base64 side by side so learners see why hex is longer, always even in length, and why uppercase A–F is the standardized form in RFC 4648 Table 5. Deliberately send an odd-length hex string or a non-hex glyph such as G or Z in a decode request to assert that your client handles invalid_input and the error message that names the rule. Keep payloads under the published character limit; multi-megabyte dumps belong offline or in dedicated binary tools. This tool is not Base64 or Base64URL—those alphabets use sixty-four symbols with padding and denser packing. It is not Base58, which drops ambiguous glyphs for human transcription. It is not a float or integer base converter: for converting a single hex number to decimal or binary, use the dedicated number-format capabilities instead of treating the digits as an opaque byte string. Failed tasks that return invalid_input do not consume prepaid balance, which keeps exploratory scripts cheap when you fuzz malformed hex.

Integration use cases

Protocol and fixture hex dumps in tests

Generate canonical uppercase Base16 from fixture text and assert decode recovers the same UTF-8 bytes in CI without a crypto dependency.

Debug pasted logs and packet traces

Paste hex dumps with spaces or colons, decode to readable text when the payload is UTF-8, or re-encode after edits for round-trip checks.

Technical questions

What happens if I decode an odd-length hex string or a non-hex character?

The API returns invalid_input, explains the odd length or names the bad character and index, and reminds you that Base16 needs even pairs of 0-9A-F. Failed tasks are not charged.

Read the full KIT documentation →

Run — free