Paste a string that was encoded once, twice or five times. Each layer — Base64, URL, hex, HTML entities, escapes, gzip, JWT — is detected and peeled until plain data is left.
Paste the string and the decoder works from the outside in. At each step it tests every supported encoding against the current data, picks the most likely one, decodes it and shows the result as a numbered layer card with the detected encoding and a confidence level. Then it tries again on that output, until nothing applies any more or 10 layers have been peeled. A cookie that is URL-encoded Base64 of gzipped JSON comes apart in three cards, and the last one is the JSON.
Detection can be wrong in both directions, so every card has two controls. Stop here keeps that layer as the final result and drops everything after it — useful when the tool keeps going past the value you actually wanted. Force as… decodes that layer with the encoding you pick, and everything below it is recomputed. When the chain ends, the last card offers the same select, so you can push one more layer that the guards declined.
| Encoding | Recognised by |
|---|---|
| Base64 / Base64url | Only the Base64 alphabet, valid length, optional = padding, line breaks allowed, data:…;base64, prefix stripped |
| URL encoding | %XX sequences; + becomes a space unless you untick the option |
| Hex | 48656c6c6f, 0x48656c6c6f, or byte-separated 48 65 6c / 48:65:6c |
| HTML entities | <, ', / — named entities are resolved by the browser's own HTML parser |
| Escapes | \uXXXX, \u{…}, \xNN (UTF-8 byte runs like \xe2\x82\xac become €), \n, \", or a whole quoted JSON string |
| Quoted-printable | =C3=A9 byte escapes and = soft line breaks |
| gzip / zlib / raw deflate | Magic bytes 1f 8b and the zlib header check on decoded bytes; raw deflate is tried only on binary data that nothing else explains |
| JWT | Three dot-separated Base64url segments whose first part is a JSON header |
Plenty of ordinary strings are technically valid Base64 or hex: Test1234, deadbeef, a UUID, a date written as digits. A naive decoder turns them into garbage. Here a layer is only accepted if its output makes sense: text must be valid UTF-8 (checked strictly, not with replacement characters) and at least 95% printable, and short inputs need a minimum length. Base64 that decodes to binary is only accepted when the input is long and looks like real Base64 — mixed upper case, lower case and digits — or when the bytes start with a known file signature. Hex that decodes to binary is only accepted with a known signature such as gzip, PNG or ZIP, because hex digits are already a readable view of those bytes. Sentences with spaces are never treated as Base64 or hex.
When the final layer is binary — a key, an image, a compressed blob the browser can't inflate — the result switches to a hex dump with offsets and an ASCII column, and a download button saves the exact bytes. gzip and zlib data is inflated with the browser's native DecompressionStream, capped at 64 MB of output. A JWT is split into header and payload and shown as JSON; the signature is not verified, and the JWT decoder is one click away for expiry dates and claims.
Base64 and Base64url (with or without padding, line breaks allowed, data: URIs), URL percent-encoding, hex (plain, 0x-prefixed or byte-separated), HTML entities (named, decimal and hex), JavaScript/JSON string escapes such as \uXXXX and \xNN, quoted-printable, gzip, zlib and raw deflate, and JSON Web Tokens.
Every layer must pass validity checks before it is accepted: the result has to be valid UTF-8 text with almost no control characters, or recognisable binary. Short words, UUIDs and plain sentences are deliberately left alone. If you know better, use the force as select on any layer to decode it your way.
Up to 10 layers per input. It stops earlier as soon as no encoding applies, and you can cut the chain at any layer with stop here.
No. It decodes the JWT header and payload so you can read them, and links to the JWT decoder for a closer look. Decoding a token does not prove it is genuine.
No. Detection and decoding, including gzip and deflate decompression through the browser's native DecompressionStream, run entirely on your device. Nothing you paste leaves the tab.
