5 tools
Encoders and decoders that keep secrets local
Encode, decode, hash and inspect tokens without any of it leaving the browser. This is the category where that guarantee matters most, because the inputs are so often credentials.
5
Tools in this category, all free
0 bytes
Uploaded — there is no server to send to
No
Account, watermark or daily limit
- Base64 Encoder & DecoderEncode text to Base64 or decode it back, with full Unicode support.
- URL Encoder & DecoderPercent-encode or decode URLs and query string values.
- HTML Entity EncoderEscape characters to HTML entities, or decode entities back to text.
- JWT DecoderDecode a JSON Web Token to inspect its header, payload and expiry.
- Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 digests of any text.
About these tools
A JWT pasted into an online decoder is, very often, a live session token. A string being Base64-decoded is frequently a credential someone is debugging. Pasting either into a tool that posts to a server hands over a working key, and the fact that most such tools are honest does not change what you have done. Everything here is computed in the page: the hashes use your browser’s own Web Crypto implementation, and the token never moves.
One distinction is worth stating plainly, because encoders are routinely mistaken for security tools. Base64 is an encoding, not encryption — it makes bytes safe to travel through systems that expect text, and anyone can reverse it instantly. Decoding a JWT shows you its header and payload but does not verify its signature, so a decoded token tells you what it claims, never whether the claim is trustworthy. And MD5 and SHA-1 are still here because you will meet them in existing systems, not because you should choose them for anything new.
Frequently asked questions
Yes. The decode happens in the page and the token is never transmitted — there is no server behind this site to transmit it to. That said, treat any token you have pasted anywhere as worth rotating if you are unsure of the page you pasted it into; the way to be certain here is to watch your network tab, which is what the verification page walks you through.
No. Base64 is a reversible encoding with no key and no secret. Anyone who has the string can read the original in one step. Use it to move binary data through a text channel, never to protect anything.
SHA-256 for anything new. MD5 and SHA-1 are broken for security purposes and are offered here because existing systems still emit them and you sometimes need to match one. For passwords specifically, a general-purpose hash of any kind is the wrong tool — those need a slow, salted algorithm designed for the job.
The rest of the toolbox
Every category works the same way — the file or the text stays on your device.