Decode multi-tool
Paste the blob. It works out what it is, unwraps it as far as it goes, and tells you what each layer was — instead of asking you to build a recipe before it will tell you anything.
Input
Everything below runs in this tab. There is no server to send it to — but a decoder is where people paste live session tokens, so treat what you put here the way you would treat it anywhere else.
Apply an operation yourself
Auto-detection refuses to unwrap a layer whose output would be noise, and some encodings — raw deflate, XOR, ROT-n — cannot be recognised by inspection at all. Pin the step yourself and detection carries on from there.
Why this instead of CyberChef?
CyberChef is excellent and this is not trying to replace it: several hundred operations and a drag-and-drop recipe graph will always beat a fixed list for deliberate, complicated work. But the job that comes up daily is not building a recipe — it is "here is a blob from a log line, what is it", and for that the recipe is pure overhead. This tool guesses, shows its confidence, and gets out of the way. When the guess is wrong, or when the encoding cannot be recognised by inspection at all, you pin the step yourself and detection carries on from there.
Decode first, judge second
password is valid base64 and deadbeef is valid hex.
Syntax proves nothing, so every candidate is actually run and the result
is scored — a layer is only accepted when what comes out looks like text, a known
container, or structured data.
Layers, not a single answer
Real payloads nest: a cookie holding base64 holding gzip holding JSON holding a JWT. Each layer is shown separately with what it was and how sure the tool is, so you can see where the interesting part actually lives.
It says what it found
A JWT with alg: none, a URL with credentials before the
@, a hostname mixing Latin and Cyrillic, an MD5 where a password hash
should be — decoding is when you are looking anyway, so the tool tells you.
Nothing leaves the tab
No uploads and no API, because there is no backend. The permalink lives in the URL fragment — never sent to a server — and is built only when you ask for it, not written into your address bar as you type.
The encodings it knows
Each of these has its own page explaining what it is, how to recognise it, and where it
shows up in security work:
base64,
JWT,
URL-encoding,
hash identification.
Alongside those the tool handles base32, hex, HTML entities, unicode escapes,
quoted-printable, data: URIs, punycode, gzip, zlib, raw deflate, JSON,
UUIDs, timestamps in six epochs, ROT-n, XOR with a key, single-byte XOR brute force,
and SHA-1/256/384/512 digests.