Smart decoder
Paste an encoded value and see every layer peeled off automatically: Base64, hex, URL encoding, gzip, JWT and more.
Decode it without guessing
Real-world values are often encoded more than once. A webhook body arrives as Base64 containing a URL-encoded form string. A Kafka header is hex. An API gateway log has a gzip payload inside Base64. Working out the layers by hand means trying several tools in turn and squinting at the output.
Paste the value and the smart decoder detects what it is, decodes it, then looks at the result and does it again, showing each step as a layer. It handles Base64 and Base64URL, hexadecimal (with spaces, colons, 0x or \x separators), percent-encoding, \u escapes, HTML entities, gzip and zlib compression and JWTs. If the final bytes are not text you get a hex dump so you can see magic numbers and structure.
How the detection works
The decoder only accepts a decoding when it produces something meaningful: valid UTF-8 text, a recognised compression header or a JWT with JSON header and payload. Plain words such as database are valid Base64 alphabet characters but decode to garbage, so they are left alone. Binary results are only offered when the input has the marks of Base64 (mixed case with digits, padding or + and /).
Safety notes
- Decoding a JWT only reads it. The signature is not verified here, so never trust the claims.
- Decompression runs with the browser's built-in streams. Very large or maliciously crafted data can still use a lot of memory, so avoid pasting untrusted multi-megabyte values.
- Everything runs locally in your browser. Tokens, keys and payloads are not uploaded.
Frequently asked questions
What can the decoder detect?
Base64 and Base64URL, hexadecimal bytes, percent (URL) encoding, \u and \x escapes, HTML entities, gzip, zlib (deflate) and JWTs. It peels one layer at a time until nothing recognisable is left.
Why does it show a hex dump?
When the decoded bytes are not valid text (an image, a protobuf message, a Kafka binary key, encrypted data) a hex dump with an ASCII column is the most useful view.
Is Base64 encryption?
No. Base64 is a reversible encoding that anyone can decode. Never use it to protect secrets, and treat any Base64 value you find in a log as readable.
What is the difference between Base64 and Base64URL?
Base64URL swaps + and / for - and _ and usually omits the = padding, so the value is safe inside URLs and JWTs. The decoder accepts both.