Encoders & Decoders
18 free toolsBase64, URL encoding, HTML entities, hex, JWT, and hashes.
Encoders and decoders handle the transformations that sit between text and the wire: Base64 and Base32, percent-encoding, HTML entities, hex and binary, plus decoders for JWTs and X.509 certificates. Each tool explains which variant it uses (base64url, encodeURIComponent versus encodeURI, RFC 4648 padding) so you can match what the other end expects.
Everything here runs in your browser: files and text are processed locally and never uploaded.
All 18 tools
Base64 Encode / Decode
Encode and decode Base64 text and files
URL Encode / Decode
Encode and decode URI components
JWT Decoder
Decode JWT tokens and inspect header, payload, and expiration
AES Encrypt / Decrypt
Encrypt and decrypt text with AES-256-GCM and a password
X.509 Certificate Decoder
Decode and inspect X.509 PEM certificates
Number Base Converter
Convert between decimal, hex, binary, and octal — with signed two's complement widths
Text ↔ Binary
Convert text to binary and back
Text ↔ Hex
Convert text to hexadecimal and back
Base32 Encode / Decode
Encode and decode Base32 (RFC 4648)
Base58 Encode / Decode
Encode and decode Base58 (Bitcoin alphabet)
Roman Numeral Converter
Convert numbers to Roman numerals and back
ROT13 & Caesar Cipher
Encode and decode ROT13, any Caesar shift, and ROT47, with a brute-force cracker
Morse Code Translator
Translate text to Morse code and back, with audio playback
XOR Cipher
XOR text or hex against a repeating key, with hex, Base64, or text output
QR Code Scanner
Scan QR codes from an image, screenshot, or your camera
HTML Entity Encoder / Decoder
Encode and decode HTML entities with named and numeric support
JWT Generator
Generate and sign JWT tokens with HMAC algorithms
CSR Generator
Generate a certificate signing request and private key in your browser, or decode an existing CSR
Guides
From the blog: the mechanisms, standards, and edge cases behind these tools.
- Base64 vs Base32 vs Base58: Choosing an Alphabet Humans Can Retype Three encodings of the same bytes, three different design goals. Why base32 is case-insensitive and 60% larger, which four characters Bitcoin deleted from base64 and why, why your TOTP secret is always 32 uppercase characters, and where each decoder is deliberately more permissive than RFC 4648 allows. Aug 31, 2026 · uses Base64 Encode / Decode, AES Encrypt / Decrypt, Number Base Converter +2
- XOR, ROT13 and Caesar: Why Toy Ciphers Still Matter XOR cipher explained — why ROT13 and Caesar are toys, why XOR sits inside AES, HMAC and ChaCha20, and how a repeating-key XOR is broken in a few seconds. Sep 6, 2026 · uses AES Encrypt / Decrypt, ROT13 & Caesar Cipher, Morse Code Translator +1
- Two's Complement: How Negative Numbers Are Stored Two's complement explained: why 255 reads as -1, why (int8_t)200 is -56, how invert-and-add-1 works, and what sign extension does when you widen a value. Sep 4, 2026 · uses Number Base Converter, Text ↔ Binary, Text ↔ Hex
- Why Your Text Shows "é" and "’": Mojibake, Decoded Garbled characters are a fingerprint: UTF-8 bytes read as Windows-1252. Lookup table of every common pattern, the exact cause, and the one-line fix. Oct 14, 2026 · uses Text ↔ Hex, HTML Entity Encoder / Decoder
- Bit Masks and Flags: The Bitwise Tricks Every Developer Should Know Set, clear, toggle and test bits, x & (x - 1), x & -x, packing RGB565 and Unix mode bits, and the JavaScript 32-bit traps that break masks above bit 30. Oct 12, 2026 · uses Number Base Converter, XOR Cipher
- Drawing Your Name on a PDF Is Not a Digital Signature Our Sign PDF tool embeds a PNG and draws it on the page. That is what almost every free "PDF signature" tool does, and under US and EU law it is usually still a valid electronic signature — but it proves nothing about whether the document changed afterward. Here is the mechanism a real PDF signature uses, and the exact legal line between the two. Aug 31, 2026 · uses X.509 Certificate Decoder, CSR Generator
- Generating a CSR Shouldn't Mean Pasting Your Private Key Into a Website A certificate signing request contains no secrets — it is your public key and subject details, self-signed to prove possession. So any CSR site that generates your key server-side or asks you to paste one has the trust model backwards. What RFC 2986 actually puts in a CSR, and how WebCrypto keeps the key on your machine. Aug 20, 2026 · uses X.509 Certificate Decoder, CSR Generator
- How JWTs Actually Work: Header, Payload, Signature & Common Mistakes A developer-friendly explainer of JSON Web Tokens — what the three parts really are, what signing does and does NOT do, how validation works, and the security mistakes that cause real breaches. Jun 4, 2026 · uses JWT Decoder, JWT Generator
- How to Write a Check Amount in Words (With Cents, Zeros, and Cents Under $1) Dollars in words, 'and', then cents over 100: $123.45 is 'One hundred twenty-three and 45/100'. Six examples, plus what wins when words and numbers disagree. Oct 15, 2026 · uses Roman Numeral Converter
- Secret Santa Without a Hat: Derangements, Exclusions, Private Links Drawing names from a hat fails about 63% of the time with 5+ people. The math of derangements, when couple exclusions make a draw impossible, and how reveal links work. Oct 15, 2026 · uses Base64 Encode / Decode
- CodeBeautify and JSONFormatter Leaked 80,000 Pastes. How to Format JSON Without Uploading It Researchers pulled cloud, database, and bank-client credentials from saved pastes on two JSON formatters. The leak was the Save feature, not the formatting. Oct 14, 2026 · uses JWT Decoder
- Why the NATO Alphabet Spells It Alfa and Juliett (and Says Niner) Why Alfa has an f, why Juliett has two t's, and how to say TREE, FIFE and NIN-er: the ICAO spelling alphabet checked against Annex 10 and ITU Appendix 14. Sep 25, 2026 · uses Morse Code Translator