All tools

Developer toolkit

Paste anything and see what it is: encode and decode Base64, URLs, HTML entities and Unicode in chained steps, and look inside every character. Free, with no account or uploads.

Paste anything

Paste text and the toolkit says what it may be (Base64, percent-encoding, HTML entities, Unicode escapes, a punycode domain) and reads it. Or open the toolkit and build a recipe of steps.

Try one

Everything happens in your browser: what you paste or open is never sent anywhere, and nothing is kept when you leave.

How it works and help

A little help along the way

Follow these steps. Every option is explained underneath. Everything happens in your browser; nothing you paste is sent anywhere.

  1. Paste anythingPaste text into the box at the top. The toolkit says what it may be (Base64, Base64url, Base32, hex, percent-encoding, HTML character references, Unicode escapes, a punycode domain, a data URL, text hiding characters) and why it thinks so. Press a guess to open it with the steps that read it.
  2. Or build a recipeOpen the toolkit, type or paste your input, or open a file, and add steps from the list on the left (on a phone, Add a step). Each step works on what the one before gave, so URL decode then Base64 decode reads Base64 that was put in an address.
  3. Set each step's optionsEach step shows its options: the Base64 alphabet and padding, which characters URL encoding keeps, whether HTML references are written by name or number, the escape style for your language. Move a step up or down or remove it.
  4. Read the notesA step says what it let pass, such as line breaks a Base64 decode passed over or a % that was not followed by two hex digits. When a step cannot go on, it says why and where, and the steps after it wait.
  5. See the resultThe result shows as text, as a hex dump, as a table of its characters with their code points, names and bytes, as a preview when it is a picture, sound, video or PDF, or as an address taken apart when it is one.
  6. SwapSwap makes the result the input and turns the recipe around, so Base64 encode becomes Base64 decode: the quickest way to check that something reads back the same.
  7. Copy, download or shareCopy the result, download it as a file (a picture as a picture), or copy a link to the recipe with its input; the link carries them after the #, which browsers never send to a server.
  8. Make and read IDsUnder IDs, make UUIDs of any version (4 and 7 are the usual ones), ULIDs, NanoIDs, KSUIDs or ObjectIds, one or up to 100,000, as lines, JSON, CSV or SQL. Paste an ID under Read an ID to see what it holds and, for most kinds, when it was made.
  9. Hash text and filesUnder Hashes, type text or add files and their hashes are shown; choose the algorithms, the form (hex or Base64), and a key for an HMAC. Paste a checksum or a SHA256SUMS file to check a download. Under Passwords, make and check bcrypt, Argon2 and scrypt hashes.
  10. Make mock dataUnder Mock data, start from Users, Orders, Nested JSON or Hostile input, or paste a JSON example, a JSON Schema or a CSV header, then change the fields: their kind, options, a share left blank, uniqueness. Choose how many rows, the seed, the language and the file (JSON, CSV, SQL, XML, YAML, TypeScript), and Make: the first rows are shown, and Download has them all.
  11. Test a regular expressionUnder Regex, choose JavaScript, PCRE2 or Go, type a pattern and a text: matches are marked as you type, each pattern run by its own engine. Replace, Split and List use the matches; What it means explains and draws the pattern; tests must or must not match; and a warning comes before catastrophic backtracking. As code writes it in eight languages.
  12. Read and make a JWTUnder JWT, paste a token (with or without Bearer): its header, payload and claims are read on this device, times counting down, with warnings for alg none, a missing expiry or a well-known secret. Verify it with a secret, a PEM key or certificate, a JWK or a key set; decrypt an encrypted one; or make and sign a token of your own.
  13. Read and build a cron scheduleUnder Cron, choose the scheduler (Unix cron, GitHub Actions, Kubernetes, Jenkins, Quartz, Spring, EventBridge or systemd) and type a schedule, or build it field by field: it is said in words, its next runs are listed in any time zone with the days clocks change marked, and it can be written for another scheduler with the file that sets it up.
  14. KeysAlt or ⌥ + I goes to the input, Alt or ⌥ + A to the steps, Alt or ⌥ + S swaps, Alt or ⌥ + C copies the result, Alt or ⌥ + D downloads it, Alt or ⌥ + L copies a link, Alt or ⌥ + N starts again, Alt or ⌥ + 1 to 7 go to Encode and decode, IDs, Hashes, Mock data, Regex, JWT and Cron, and Ctrl or ⌘ + / lists the keys.
Every option explained
Base64 and Base64url
Base64 (RFC 4648) writes three bytes as four characters with A–Z, a–z, 0–9, + and /, padded with =. Base64url uses - and _ so it can go in an address, and JWTs leave its padding out. Email writes Base64 in lines of 76 characters, PEM keys in lines of 64.
Forgiving and strict decoding
As browsers do, decoding passes over spaces and line breaks and does not need the padding; the notes say when it did. Strict refuses both, and a last character whose spare bits are not zero.
What URL encoding keeps
A part of an address keeps letters, digits and - _ . ! ~ * ' ( ), like JavaScript's encodeURIComponent. A whole address also keeps / ? # & = and the like, like encodeURI. A form writes spaces as + and keeps only * - . _. Text is encoded as its UTF-8 bytes.
HTML character references
Only & < > " ' must be escaped in HTML. Names come from HTML's own list of 2,231. Decoding follows the HTML standard: some names may go without a semicolon in text, and in an attribute &copy= is left alone, as browsers do.
Unicode escapes
JavaScript and JSON write \u00E9, with two for a character beyond the first 65,536 (a surrogate pair); Rust and modern JavaScript write \u{1F600}; Python \xe9, \u20ac and \U0001f600; CSS \E9 followed by a space; HTML &#xE9;.
Normalising
The same letter can be stored two ways: é as one character, or e and a combining accent. NFC joins them (what the web uses), NFD splits them (what macOS file names keep), and NFKC and NFKD also fold look-alike forms such as fi and ².
Hidden and look-alike characters
Zero-width spaces, bidi controls (which can make code read differently from how it runs, CVE-2021-42574) and tag characters cannot be seen. The Characters view marks them, and those Unicode lists as easily taken for another, such as the Cyrillic а in аpple.com.
Punycode and domains
Domain to punycode writes a name with letters beyond ASCII as DNS keeps it (xn--), with the rules of UTS #46 that browsers follow. Punycode encode is the raw form for one label.
Files
Open any file of up to 100 MB to encode it, as Base64 or a data URL. A result that is a file (a PNG, a PDF, an MP3) is recognised by its first bytes and can be previewed and downloaded.
UUID versions
Version 4 is random. Version 7 starts with the time in milliseconds, so new ones sort after old ones (good for database keys). Versions 1 and 6 hold a finer time and a node, here a random one. Versions 3, 5 and 8 are made from a namespace and a name with MD5, SHA-1 or SHA-256, the same every time (RFC 9562).
Time in an ID
ULIDs, UUIDs of versions 1, 6 and 7, KSUIDs, ObjectIds and Snowflake IDs hold the time they were made, which Read an ID shows. A Snowflake ID is read by its platform's epoch: X's, Discord's, or one you give.
Hash algorithms
SHA-256 and SHA-512 are the usual choice; SHA-3 and BLAKE3 are newer. MD5 and SHA-1 are broken for security (two files can share one) but still spot accidents. CRC-32, Adler-32 and xxHash are fast checksums, never for security, and cannot be keyed.
Password hashes
bcrypt, Argon2 and scrypt are slow on purpose. Their settings start at OWASP's recommendations. bcrypt reads only a password's first 72 bytes. This page is for trying settings and checking stored hashes; a real system hashes passwords on its own server.
JWT signatures
Reading a token never checks it: anyone can write a header and payload. Verify checks that the signature was made with the key given over exactly these parts. HS algorithms share one secret; RS, PS, ES and EdDSA sign with a private key and verify with its public key. A valid signature says who held the key, not that the claims are true.
Cron dialects
Unix cron, GitHub and Kubernetes have five fields; Quartz and Spring start with seconds; EventBridge ends with the year and needs ? in one day field; Quartz and EventBridge count weekdays from Sunday as 1. When both day fields are set, cron runs on either; Quartz, Spring, Jenkins and systemd need both. Jenkins' H is a value worked out from the job's name.
Private
Everything runs in your browser. Nothing you type or open is sent anywhere or kept when you leave. A token, secret or key is never kept or put in a share link; Fetch the JWKS asks the issuer for its public keys only when pressed. A share link carries what you typed after the #, which is never sent to a server, but anyone who has the link can read it.
Read the step-by-step guide

Guides

Same tool, other jobs

Tools nearby