Multi-Format Encoder & Decoder

Web development constantly requires translating strings between transport formats - decoding a Base64-encoded webhook payload, inspecting the expiration timestamp (exp) inside a JWT Bearer token, escaping URL query parameters, or computing a SHA-256 checksum. This all-in-one local encoder and decoder handles UTF-8 safe Base64, URL percent-encoding, JWT header/payload inspection, HTML entities, Hex/Binary conversion, and Web Crypto cryptographic hashing directly in your browser with zero server calls.

Why developers keep a multi-format encoder/decoder open

Running echo -n "..." | base64 -d in a terminal works for simple ASCII strings, but breaks or gets messy when dealing with URL-safe Base64 (base64url), multi-byte UTF-8 emojis, nested query URLs, or three-part JSON Web Tokens:

• Inspecting JWT (eyJ...) headers, claims, and expiration times: Splitting a Bearer token into its Header (alg, typ), Payload (sub, iat, exp, roles), and Signature - and translating Unix epoch timestamps like 1761724800 into human-readable dates so you know immediately if a token is expired.
• UTF-8 safe Base64 and Base64URL encoding: Browser atob() and btoa() throw a DOMException: The string to be encoded contains characters outside of the Latin1 range whenever your string contains curly quotes, Indian rupee symbols (₹), accented characters, or emojis. Our UTF-8 byte pipeline (TextEncoder / TextDecoder) encodes and decodes any Unicode string cleanly.
• URL percent-encoding (encodeURIComponent): Escaping reserved characters (&, =, ?, +, /, #) before passing a callback URL or search filter inside a query string parameter.
• HTML entity escaping: Converting <script> tags and quotes into <script> and " for safe display inside HTML templates or documentation.
• One-way cryptographic hashing (SHA-1, SHA-256, SHA-384, SHA-512): Generating hex digests for webhook signature verification, Subresource Integrity (SRI), or cache keys.

How to encode, decode, inspect JWTs, or hash strings step by step

Method 1: Reversible Text & Payload Translation (Base64, URL, HTML Entities, Hex / Binary)

1. Select your target format tab: Click Base64 (UTF-8 & Base64URL safe), URL Encode/Decode (encodeURIComponent), HTML Entities (<, "), or Hex / Binary in the top mode bar.
2. Choose direction: Toggle between Encode (plaintext → transport format) and Decode (encoded payload → readable UTF-8 text).
3. Paste or type your input: Enter your string in the left/top editor—the translated output updates on every keystroke without choking on multi-byte emojis or currency symbols.
4. Copy or chain: Click Copy Output to grab the result, or switch tabs to apply a second transformation.

Method 2: Inspecting a JSON Web Token (JWT Inspector Mode)

1. Switch to the JWT tab: Select JWT Inspector / Decoder from the mode selector.
2. Paste the eyJ... Bearer token: Paste the three-part dot-separated token (header.payload.signature) from your browser DevTools Authorization header or OAuth callback.
3. Audit decoded claims and expiration: Inspect the pretty-printed Header (alg, typ) and Payload (sub, role, iat, exp) alongside the automatic human-readable timestamp badge that flags whether exp is currently active or EXPIRED.

Method 3: Generating One-Way Cryptographic Digests (SHA-1 / SHA-256 / SHA-384 / SHA-512)

1. Open the Hash Generator tab: Select Hash (SHA) in the mode bar and pick your digest bit-length (SHA-256, SHA-384, SHA-512, or SHA-1).
2. Enter the exact payload: Paste your webhook body, password salt string, or file text into the input box.
3. Copy the hardware-computed hex digest: The browser's native Web Crypto API (crypto.subtle.digest) immediately outputs the exact hexadecimal checksum ready for signature verification or Subresource Integrity (SRI) checks.

Technical details that prevent subtle encoding bugs

Unicode-safe Base64 & Base64URL (- and _ instead of + and /)

Standard Base64 uses +, /, and = padding, while OAuth, JWTs, and URL tokens use Base64URL (- and _ without padding). The decoder automatically normalizes Base64URL characters and missing = padding before decoding through a Uint8Array UTF-8 decoder, so both standard Base64 and JWT segments decode without errors.

Live JWT claim parser with expiration status

When you paste a header.payload.signature JWT string into the JWT mode, the tool decodes the first two Base64URL segments, pretty-prints the JSON structures, and checks exp (expiration time) and iat (issued at) against your current clock.

Native Web Crypto (crypto.subtle.digest) SHA hashing

Hash calculations use your browser's native hardware-accelerated window.crypto.subtle.digest implementation to compute exact SHA-1, SHA-256, SHA-384, and SHA-512 hexadecimal digests in microseconds.

A real example: inspecting an expired OAuth JWT and verifying a SHA-256 hash

Suppose an API call returns 401 Unauthorized when you send this Bearer token:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfNDgyMSIsInJvbGUiOiJhZG1pbiIsImV4cCI6MTczNTY4OTYwMH0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

1. Switch to JWT Decoder and paste the token.
2. The tool splits the dots and decodes the Header: { "alg": "HS256", "typ": "JWT" }
3. And decodes the Payload: { "sub": "usr_4821", "role": "admin", "exp": 1735689600 }
4. Beside exp: 1735689600, the human timestamp readout displays 2025-01-01 00:00:00 UTC (EXPIRED) - confirming immediately that the token expired and needs refreshing rather than debugging your role permissions!
5. Next, switch to Hash (SHA-256) and type shifttools: the tool outputs the exact 64-character hex digest 8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4 (computed directly from the UTF-8 byte array).

Practical tips and security reminders

• Encoding is NOT encryption: Base64, Hex, and URL encoding are public data representations, not encryption. Anyone can decode a Base64 string or read the payload of an unencrypted JWT (JWS) without knowing your secret key. Never store unencrypted secrets in client-side Base64 assuming they are hidden.
• Hashes (SHA-256) are one-way: Unlike Base64 or URL encoding, a cryptographic hash function (SHA-256, SHA-512) is a one-way mathematical digest - it cannot be "decoded" back into the original input text.

Handling URL query strings vs full URLs (encodeURIComponent vs encodeURI)

When building API requests, encoding an entire URL with encodeURIComponent accidentally escapes the protocol colons and slashes (https%3A%2F%2F), breaking browser navigation. Always encode individual parameter values (such as a callback URL or search query containing &, +, or =) while keeping the base domain and path delimiters unescaped.

Privacy and 100% local execution

Pasting production JWT Bearer tokens, HTTP Basic Auth (username:password) Base64 strings, or API keys into a server-backed website leaks live credentials. Every conversion, JWT decode, and crypto.subtle hash in this tool runs 100% locally inside your browser tab with zero network requests.

Quick comparison of common web encoding and digest formats

Knowing which representation a protocol expects prevents corrupted payloads and failed signature checks:

• Standard Base64 (RFC 4648 §4): Uses A–Z, a–z, 0–9, +, / with = padding. Used in MIME email attachments, Data URLs (data:image/png;base64,...), and HTTP Basic Authentication headers (Authorization: Basic ...). Every 3 bytes of binary input become 4 ASCII characters (~33% size overhead).
• Base64URL (RFC 4648 §5): Replaces + with - and / with _ and omits trailing = padding so tokens can sit safely inside URL paths and query strings without percent-escaping. Used in all JSON Web Tokens (JWT) and OAuth PKCE code challenges.
• Hexadecimal (Base16): Encodes each byte as two hex digits (00 to ff), doubling string length (100% overhead). Standard format for cryptographic hash digests (SHA-256 = 32 bytes = 64 hex chars), MAC addresses, and encryption keys.

Related tools

Need to format a large JSON payload after decoding it from Base64? Open the JSON Formatter & Validator. To generate cryptographically random secrets for signing tokens, use the Password Generator, or scrub leaked tokens out of .har network captures with HAR File Sanitizer. Read our guide on how to use the online encoder and decoder.