Runs offline in your browser

Encode, decode, hash and inspect

Fast, private tools for Base64, URL encoding, JWTs, hashes, UUIDs and passwords. Everything runs in your browser, so tokens and secrets are never transmitted.

● Every tool runs in your browser. What you paste never leaves your machine.

Base64 DecodeDecode and encode Base64, including the URL-safe variant.URL EncodePercent-encode and decode URLs, with component and full-URL modes.JWT DecoderDecode a JWT and read its claims, with expiry checked locally.Hash GeneratorMD5, SHA-1, SHA-256 and SHA-512 digests of any text.UUID GeneratorGenerate v4 random or v7 time-ordered UUIDs in bulk.Password GeneratorStrong random passwords and passphrases, with entropy shown.

Why these tools should run locally

Most of what people paste into an encoder or a token decoder is a credential. A JWT is a live session. A Base64 blob out of a configuration file is usually a key. A hash being checked is often attached to something confidential.

Every tool here runs as JavaScript in your browser. There is no upload step, no API call, and no server-side processing of any kind. That removes the question of whether pasting a production token into a website counts as a disclosure, because the token is never sent anywhere. The only request a page makes after loading is a cookieless page-view count carrying the page's own URL, described on the privacy page.

Built to be fast

The established tools in this category work but have accumulated a great deal of advertising, and it is normal to wait most of a second for a page to become usable. Each page here is a single request with its styles and code inlined, with no web fonts and no framework, and two ad slots placed below the tool rather than around it.

Correctness notes

Base64 handling encodes to UTF-8 first, so Unicode round-trips properly rather than throwing or corrupting. Random values come from the browser's cryptographic generator with rejection sampling rather than a biased modulo. Where a tool cannot do something safely, such as verifying a JWT signature without a key, it says so rather than pretending.