tool · one of 34free, no counter
Encoders
Where can I decode this without pasting it into a website?
The argument for this is not that a browser cannot do base64. It is that every one of these is otherwise done on a website that receives the input, and what people paste into an online decoder is a webhook body, a session payload or a token. Nothing here leaves the device, nothing is stored, and there is no request to make.
Reach itPress ⌘+K on any tab and type encoders.Ctrl+Kon Windows and Linux
TWO BUILDS9 browsers
Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome buildin the panel · free, no counter
What this actually is
base64, url, html, jwt, hashes, uuids and timestamps, none of it sent anywhereDecoding a payload from a log, checking what a signed URL actually contains, hashing a string against a webhook signature, renaming a column list from snake_case to camelCase, deduplicating a column pasted off the page, or working out whether a timestamp is seconds or milliseconds.
Asked about this tool
6 of themWhy does the JWT decoder open in a separate window?
A JWT is a bearer token. Both the floating panel and the frame beside it are drawn in the page’s own document, so the site can put a convincing copy of either over itself and ask for the same paste - the same reason API keys are never typed there. Every other transform is drawn in the frame; the ones that take a credential are named and open a real browser window whose address you can read.
Why is this a window rather than a panel tool?
Because the job is a comparison: what went in against what came out. Stacked in a 340px column that means scrolling between the two halves of the one thing being read, so it opens beside the panel with the input on the left and the output on the right, each with its own line numbers.
Does it verify a JWT signature?
No, and it says so on every result. Verification needs the key, and asking for one would be asking for the only part of a token that matters.
Why does base64 here handle emoji when btoa does not?
`btoa` takes code units below 256 and throws on anything else. Everything here goes through TextEncoder, so a round trip of any text is the text.
Why are there two URL encoders?
Because `encodeURIComponent` escapes `/`, `?` and `&` and `encodeURI` does not. One is for a value in a query and the other is for an address that is already structured, and using the wrong one is the entire bug class.
Is MD5 available?
No. Web Crypto does not implement it, and shipping a hand-written one would put it beside SHA-256 as though the choice were a preference rather than a mistake.
TWO BUILDS9 browsers
Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome build63 of these · no host permissions · three free audits