Universal String Decoder
Paste that mystery string from a log, config file, cookie or API response. The decoder recognises Base64, JWT, percent-encoded URLs, hex bytes, Unix timestamps, Unicode and HTML escapes, MIME subject lines, Punycode domains, hashes and more, and unwraps layered data like URL → Base64 → gzip → JSON one step at a time. Everything runs in your browser; nothing is uploaded or stored.
Paste a string and the result appears here.
Other possible interpretations
How detection works
Your input is run through about twenty detectors at once. Each one reports whether the string reads as its format and how confident it is (0–100), and the best match is shown as the result. Because the same characters can be valid in several formats (32 hex digits could be an MD5 hash or Base64), the remaining candidates stay available under "Other possible interpretations". If the result is itself decodable (Base64 that turns out to be gzip that turns out to be JSON) the decoder keeps going, up to four steps, and shows the path it took. If you already know the format, pick it from the dropdown.
| Format | What it looks for | What you get |
|---|---|---|
| Base64 / data URI | A–Z a–z 0–9 + / (or - _), length a multiple of 4 | Text if it is UTF-8; otherwise the file type (PNG, PDF, ZIP…) with a download; gzip and zlib are decompressed |
| JWT | xxx.yyy.zzz with an alg in the header | Header and payload as JSON, exp/iat/nbf as dates, expired or not |
| URL encoding | %C3%A9-style percent escapes | Decoded text, repeated for double encoding; host, path and a query-parameter table for full URLs |
| Hex | An even number of hex digits (0x, spaces and colons allowed) | Text or a detected file type |
| Hash | 32/40/64/128 hex digits, or prefixes like $2b$, $argon2id$, $6$ | Possible algorithms (hashes cannot be reversed) |
| Timestamp | 9–19 digit numbers, or date strings | Seconds/ms/µs/ns interpretations in your time zone and UTC; dates become timestamps |
| Unicode & HTML | é U+00E9 é é \xC3\xA9 | The actual characters |
| Mojibake | Clusters like é ’ ü | Text recovered by re-reading the bytes as UTF-8, plus Unicode normalization |
| MIME | =?UTF-8?B?…?=, =C3=A9 | Email subject or body text |
| Punycode | Domain labels starting with xn-- | The Unicode domain name |
| Base32 / Base58 / Ascii85 | Alphabet and length rules, Base58Check checksum | Text or hex; Bitcoin address type |
| Binary / decimal bytes / Morse / ROT13 | 8-bit groups, 0–255 lists, dots and dashes, English word score | Text |
| Identify | IPv4/IPv6, MAC, email, UUID, ISBN, card numbers, colour codes, API key formats | What it is, with details (private or public, version, check digit, masked number) |
What can and cannot be decoded
- Encodings (Base64, URL, hex, Unicode escapes) only change how bytes are written down. Anyone can reverse them, so they never protect secrets.
- Hashes (MD5, SHA-256, bcrypt) are one-way. This tool only tells you which algorithm a hash probably came from; if you know the original text, recompute it in the hash calculator and compare.
- Encryption (AES, RSA, JWE) needs the key. If Base64 decodes to meaningless bytes, you are probably looking at ciphertext, compressed data or a binary file.
- Lost characters: text where characters became
?or�cannot be repaired, because the original bytes are gone. Re-export the source as UTF-8.
Strings you will run into
Authorization: Bearer eyJhbGciOi…— a JWT. The third part is a signature that needs the server's key, so this tool shows the contents without verifying it. Details on the JWT decoder page.Authorization: Basic dXNlcjpwYXNz— HTTP Basic auth; decoding the Base64 revealsuser:passwordin clear text.q=caf%C3%A9in a search URL — percent-encoded UTF-8. The URL encoder & decoder also encodes text for you.1761200000or1761200000123in logs — Unix time in seconds or milliseconds. See the timestamp converter.It’s caféfrom a CSV or email — UTF-8 misread as Windows-1252. The mojibake fixer explains the causes.H4sIAAAA…— gzip wrapped in Base64, common in config files, cookies and compressed logs.eJ…andeNp…are zlib.
FAQ
Is it safe to paste tokens or passwords?
Detection and decoding happen entirely in your browser. Nothing is sent to a server, stored, or remembered between visits. That said, if a password or API key you use shows up in the result and you did not create the original string yourself, that value is circulating somewhere else, which is a security risk: change that password or key.
It says no known format matched.
The string may have extra characters around it (quotes, Bearer, line numbers), may be plain text, or may be encrypted or compressed. Trim it to the relevant part or choose a format manually.
The result looks wrong.
Short strings are often valid in several formats, so auto-detection can pick a different reading than you expected. Open "Other possible interpretations" or set the format explicitly. Dates without a time zone are read in your browser's time zone.
Sources
- Base64 and Base32: RFC 4648; JWT: RFC 7519; URL encoding: RFC 3986
- MIME encoded words: RFC 2047; Punycode: RFC 3492; gzip and zlib: RFC 1952, RFC 1950
- Character encodings: WHATWG Encoding Standard; Unicode normalization: UAX #15; card numbers: ISO/IEC 7812 (Luhn)
Found this useful? Share it
Only the page link is shared. Your inputs and files are never included.