LegitInformant

Decoder ring - Base64, URL, hex, JWT and more

Auto-detects Base64, hex, percent-encoding, entities and JWTs, then peels nested layers until it hits plain text.

Nothing leaves your browser. This tool does its work on your own machine — there is no upload, no server request, and nothing is stored.

Paste anything. The encoding is detected automatically, and nested layers are peeled one at a time.

What each encoding is for

None of these is encryption. Every one is a reversible way of writing bytes using a restricted set of characters, invented so data survives a channel that would otherwise mangle it. Anyone can undo any of them, which is exactly why finding one wrapped around a payload tells you the author wanted a filter to look away, not that the contents are protected.

Base64

Turns arbitrary bytes into 64 safe characters, at a cost of a third more length. It is how attachments travel inside email, and how a script gets smuggled past a scanner that only reads plain text. The URL-safe variant swaps + and / for - and _, and usually drops the = padding.

Percent-encoding

The %20 style used in URLs. Legitimate everywhere, and abused by encoding a second URL inside a query parameter — often twice, so that a single-pass decoder shows something harmless.

Hex, entities and ROT13

Hexadecimal writes each byte as two characters. HTML entities (h) render as text in a browser but defeat a naive string search. ROT13 is a letter rotation with no security value at all, still used to hide spoilers and, occasionally, to make a payload look like noise.

JWTs

A JSON Web Token is three Base64url segments separated by dots: a header, a set of claims, and a signature. The first two are not secret — anyone holding the token can read them, which is what this tool does. The signature is what makes the token trustworthy to a server, and it cannot be checked without the key.

A JWT is a live credential until it expires. If you found one somewhere it should not be, treat it the way you would treat a password.

Why layers matter

Real payloads are commonly wrapped two or three deep — Base64 inside percent-encoding inside an entity, say — precisely because most decoders stop after one pass and display something that looks harmless. This tool keeps going until the result stops looking encoded, and shows you every layer it removed.

Common questions

How do I know which encoding something uses?

You usually do not, which is why this tool guesses. Paste the string and it scores it against each encoding, decodes with the best match, then tries again on the result. Attackers commonly wrap a payload two or three layers deep precisely to defeat a single-pass decoder.

Is it safe to decode a JWT here?

The decoding is local, so nothing is transmitted. But a JWT is a live credential until it expires: treat one you found somewhere as sensitive, and never paste your own into a site that sends it anywhere.

Why does my Base64 fail to decode?

Usually padding or alphabet. URL-safe Base64 swaps + and / for - and _, and often drops the trailing = signs. This tool tries both alphabets and repairs missing padding before giving up.

These tools check form, not honesty. A valid checksum, a passing SPF record or a decoded link tells you something is well formed — never that the person behind it is telling the truth. When money is involved, verify on a phone number you already had, and run the link or address through the full check as well.