About decoder.tools

Decoding is a small task that interrupts real work constantly. A Base64 blob in a log line, a JWT that a service rejected, a percent-encoded redirect URL, a certificate that expires at the wrong moment, a VIN on a listing, a cron line nobody can read. Each one is a thirty-second question — and answering it usually means searching for a single-purpose site covered in ads, or pasting something sensitive into a server you know nothing about.

decoder.tools exists to make that thirty seconds actually take thirty seconds. One site, 90 formats, a consistent interface, and a page per format that explains what you are looking at rather than just spitting out a string.

Every decoder here is pure client-side JavaScript. When you paste something, it is processed by the page already loaded in your browser — there is no request to a server, nothing is logged, and nothing is stored. Close the tab and the data is gone.

This is not a feature we added; it is the constraint the whole site is built around. The things people need to decode are exactly the things that should not be uploaded: access tokens, session cookies, SAML assertions, private packet captures, photographs with GPS metadata in them. A tool that quietly posts those to a backend is a liability regardless of what its privacy policy says.

The trade-off is honest: a few decoders that would genuinely require a server — large database lookups, for instance — are either scoped down to what can be done locally or clearly marked as unavailable. We would rather ship less than break the rule.

• Developers debugging tokens, encodings, headers and payloads that arrived in a shape they did not expect.
• Security researchers and CTF players unwrapping layered encodings, ciphers, steganography and obfuscated payloads.
• Sysadmins and network engineers reading packet headers, certificates, subnet ranges, cron schedules and permission bits.
• Anyone with a number they need to understand — a VIN, an IBAN, an IMEI, a barcode, a timestamp.

90 tools across nine categories, 48 of them live today and the rest in development. Tools that are not yet built are marked plainly on their page — you will never get a fake result from a decoder that does not work yet.

• Data, Radix & String
• Web, API & Tokens
• Security, PKI & Crypto
• Classical & Obfuscated Ciphers
• Image, Media & Steganography
• Network, System & Packets
• Hardware, Radio & Telecom
• File Format & Archives
• Identification & Serials

Browse the full catalog →

Every tool page carries a written explainer: what the format is, a spec table of the details worth knowing, how to use the tool, when you would reach for it, and answers to the questions people genuinely ask about that format. They are written per tool, not generated from a template, and reviewed against the relevant standards and RFCs.

If you find something inaccurate — a wrong field width, an outdated recommendation, a claim that has stopped being true — please tell us. Corrections are welcome and get fixed quickly.

Nothing. There is no account, no paid tier, no rate limit and no feature held back. The site is cheap to run precisely because it does no server-side work — decoding happens on your machine, not ours.

Bug reports, missing formats, corrections and general feedback all go to the same place: contact@decoder.tools. See the contact page for what to include, the privacy policy for exactly what is and is not collected, and the terms of use for the legal position.