Decoder ring - Base64, URL, hex, JWT and more
Auto-detects Base64, hex, percent-encoding, entities and JWTs, then peels nested layers until it hits plain text.
Nothing leaves your browser. This tool does its work on your own machine — there is no upload, no server request, and nothing is stored.
What each encoding is for
None of these is encryption. Every one is a reversible way of writing bytes using a restricted set of characters, invented so data survives a channel that would otherwise mangle it. Anyone can undo any of them, which is exactly why finding one wrapped around a payload tells you the author wanted a filter to look away, not that the contents are protected.
Base64
Turns arbitrary bytes into 64 safe characters, at a cost of a third more length. It
is how attachments travel inside email, and how a script gets smuggled past a scanner
that only reads plain text. The URL-safe variant swaps + and
/ for - and _, and usually drops the
= padding.
Percent-encoding
The %20 style used in URLs. Legitimate everywhere, and abused by
encoding a second URL inside a query parameter — often twice, so that a single-pass
decoder shows something harmless.
Hex, entities and ROT13
Hexadecimal writes each byte as two characters. HTML entities
(h) render as text in a browser but defeat a naive string
search. ROT13 is a letter rotation with no security value at all, still used to hide
spoilers and, occasionally, to make a payload look like noise.
JWTs
A JSON Web Token is three Base64url segments separated by dots: a header, a set of claims, and a signature. The first two are not secret — anyone holding the token can read them, which is what this tool does. The signature is what makes the token trustworthy to a server, and it cannot be checked without the key.
A JWT is a live credential until it expires. If you found one somewhere it should not be, treat it the way you would treat a password.
Why layers matter
Real payloads are commonly wrapped two or three deep — Base64 inside percent-encoding inside an entity, say — precisely because most decoders stop after one pass and display something that looks harmless. This tool keeps going until the result stops looking encoded, and shows you every layer it removed.
Common questions
How do I know which encoding something uses?
You usually do not, which is why this tool guesses. Paste the string and it scores it against each encoding, decodes with the best match, then tries again on the result. Attackers commonly wrap a payload two or three layers deep precisely to defeat a single-pass decoder.
Is it safe to decode a JWT here?
The decoding is local, so nothing is transmitted. But a JWT is a live credential until it expires: treat one you found somewhere as sensitive, and never paste your own into a site that sends it anywhere.
Why does my Base64 fail to decode?
Usually padding or alphabet. URL-safe Base64 swaps + and / for - and _, and often drops the trailing = signs. This tool tries both alphabets and repairs missing padding before giving up.