Base64, URL, hex and JWT decoder
Encode and decode Base64, URL encoding and hex, and read JWT headers and payloads. Nothing leaves your browser.
A decoded token is not a verified token
The JWT reader shows the header and payload and translates the time claims. It does not check the signature, so never treat decoded content as trusted. Base64, URL encoding and hex convert in both directions and handle UTF-8 correctly.
More tools
- Password leak checkCheck whether a password appears in known data breaches. It is hashed in your browser; only the first five characters of the hash are sent (k-anonymity).
- CVSS 3.1 calculatorBuild a CVSS 3.1 base vector and get the score instantly. Runs in your browser, with a visual plot of the result.
- Email security check: SPF, DMARC, DNSSECRead a domain’s SPF, DMARC, MX, DNSSEC, MTA-STS and CAA records live from DNS and see whether its mail can be forged.
- SHA-256, SHA-1 and SHA-512 hash calculatorHash text or files with SHA-256, SHA-1 and SHA-512. Computed locally; files are never uploaded.
- IOC extractor and defangerExtract IPs, domains, URLs, hashes and CVE IDs from any text and get them deduplicated and defanged.
- IPv4 subnet calculatorNetwork, broadcast, usable range, netmask and wildcard for any IPv4 CIDR block.
- Secure password generatorGenerate long random passwords from your browser’s cryptographic source, without look-alike characters.