Which web tool do I need
| What you have | Looks like | Tool |
|---|---|---|
| A JSON Web Token | eyJhbGci….eyJzdWIi….sig | JWT decoder, JWT encoder |
| An Authorization header | Basic dXNlcjpwYXNz | Basic Auth decoder, Basic Auth header |
Base64 with - and _, no = | SGVsbG8_d29ybGQ | Base64URL decoder, Base64URL encoder |
| Convert between the two alphabets | Base64 to Base64URL, Base64URL to Base64 | |
| A data URI | data:image/png;base64,… | Data URI parser, Data URI generator |
| A SAML message | SAMLResponse=PHNhbWxwOl… | SAML decoder |
| A Kubernetes Secret | data: values in YAML | Kubernetes Secret decoder |
| An image pull secret | eyJhdXRocyI6… | .dockerconfigjson decoder |
| Compressed Base64 | H4sI… or eJ… | Gzip Base64 decoder; to create: gzip, zlib |
| A JSON document with encoded fields | "body": "eyJ…" | Base64 in JSON |
| An encoded PowerShell command | powershell -enc JABzAD0A… | PowerShell -EncodedCommand |
| Raw email source | Content-Transfer-Encoding: base64 | Email decoder, Quoted-printable |
| URL-encoded text | q=caf%C3%A9%20menu | URL decode, URL encode |
| HTML-escaped text | <p>Café</p> | HTML entities |
Layers on top of layers
Web payloads are often wrapped several times, and each layer needs its own tool. A few common stacks:
- Pull secrets: Kubernetes Base64 around Docker JSON around a Base64
user:password. The .dockerconfigjson decoder unwraps all three. - SAML Redirect: XML, raw deflate, Base64, URL encoding. The SAML decoder reverses the whole chain.
- Helm releases: JSON, gzip, Base64, and Kubernetes Base64 again.
- Redirect URLs: a URL-encoded URL inside a query parameter, sometimes encoded twice. The URL decoder’s Decode repeatedly option handles that.
- Flask session cookies: JSON, optionally zlib-compressed (a leading
.marks that), Base64URL, then a timestamp and a signature, joined with dots.
When a decoded result still looks encoded, check its first characters against the table above and continue with the matching tool.
Encoding is not protection
None of these formats hide anything. A JWT payload, a Basic Auth header, a Kubernetes Secret and a SAML assertion can all be read by anyone who sees them; only a signature or real encryption adds security. The decoders here are useful precisely because of that, and the same reason makes it worth keeping such strings out of logs, screenshots and tickets. More in encoding vs encryption.
For certificates, SSH keys and hashes, see keys and certificates. For plain strings and charsets, the text tools.
FAQ
How can I tell what kind of encoded string I have?
By its shape: three dot-separated parts starting eyJ are a JWT, % with two hex digits is URL encoding, & is HTML escaping, H4sI is gzip, and - or _ in Base64 mean Base64URL. The table on this page lists more patterns and where each one goes.
Are these tools safe for production tokens and secrets?
They run in your browser, and the page’s Content Security Policy blocks every network request except Cloudflare’s page-view count, so pasted data cannot be sent anywhere. Treat live tokens with care anyway and rotate any secret that was exposed elsewhere.
What is the difference between URL encoding and Base64URL?
URL encoding escapes individual characters as %XX and keeps the rest readable. Base64URL turns arbitrary bytes into letters, digits, - and _. Use URL encoding for text values, Base64URL for binary data and tokens.