Base64, URL and HTML encoding
Base64, percent-encoding and HTML entities solve the same underlying problem, fitting a byte that a text format refuses, but each one defines that refusal differently, and mixing the three up produces a corrupted string instead of a visible error.
10 characters become 11 bytes (ã takes 2 bytes in UTF-8) and the Base64 output is 16 characters, the 4/3 growth rounded up to the nearest multiple of 4.
=, & and the space are reserved inside a query string component; outside that component (in a path, for example), the RFC 3986 reserved set is different.
The 5 escaped characters (& < > " ') are enough for the browser to never read the text as a new tag, without removing a single letter from the original content.
Standard Base64 uses the + and / characters and pads the end with = (padding). Because +, / and = have meaning in URLs, the URL-safe variant (defined in RFC 4648) replaces them with - and _ and removes the padding, letting you use the result in URLs, file names and tokens such as JWTs without escaping anything. Decoding here accepts both variants automatically.
No. Base64 is reversible without any key, anyone with the string can decode it in one line; it exists to carry binary bytes through a text channel (an email attachment, a JSON field), not to hide content.
Every reserved or non-printable-ASCII byte becomes 3 characters (%XX), so text with many spaces, accented letters or symbols like & and = can nearly triple in size; letters, digits and a handful of symbols (- _ . ~) are never encoded.
Because `é` takes more than 1 byte in UTF-8; if decoding assumes Latin-1 (1 byte per character) or cuts the string mid multi-byte character, the result comes out with replacement or garbled characters, even with the right encoding scheme applied.
None in the rendered result, both produce the & character; & is the named entity and & is the decimal numeric reference for the same character code, and an HTML parser accepts either form.
All encoding and decoding happens in your browser. No text is sent to any server, safe for tokens, payloads and sensitive data.