Decoder
The Decoder tool encodes and decodes data in various formats: URL, HTML, Base64, Hex, Octal, Binary, and Gzip. It also supports chaining multiple encoding operations, which is essential for decoding multi-layer obfuscated payloads.
Encoded data hides malicious payloads from simple signature-based detection. The Decoder helps you see through the obfuscation during manual testing.
Using the Decoder
Open Decoder from the top menu or the Window menu. Paste your data into the input field, choose the operation, and see the output live.
Decode
Convert encoded data back to its original form. Use when you find suspicious encoded strings in requests/responses.
Encode
Convert raw data into a specific format. Useful when you need to generate a payload that matches the target encoding.
Smart Decode
Attempts multiple decode operations automatically to peel layers of obfuscation.
Smart Encode
Auto-applies appropriate encoding based on context (URL, HTML, both).
Supported Encodings
| Encoding | Decode | Encode | Example |
|---|---|---|---|
| URL Encode | decode URL-encoded text | URL-encode text | %20%3C%3E |
| HTML Encode | decode HTML entities | HTML-encode special chars | <script> |
| Base64 | decode Base64 to raw bytes | encode to Base64 | SGVsbG8gV29ybGQ= |
| Hex | hex → ASCII/UTF-8 | ASCII/UTF-8 → hex | 48656c6c6f |
| ASCII Hex | hex chars representing ASCII bytes | ASCII bytes to hex chars | 0x48 0x65 0x6c 0x6c 0x6f |
| Octal | octal → text | text → octal | 110 145 154 154 157 |
| Binary | binary string → text | text → binary string | 01001000 01100101 |
| Gzip Compress | decompress gzipped data | compress with gzip | compressed blob |
Common Use Cases
Decode obfuscated JavaScript
Web applications often obfuscate malicious payloads. Use Decoder to reverse encoding chains.
Paste obfuscated code → try Base64 decode → try URL decode → try HTML decode. Repeat until readable.
Decode JWT tokens
JWTs use Base64URL encoding. Decode the payload to read claims before tampering.
Copy JWT → Base64 decode (URL-safe variant) → JSON pretty-print → modify claims → re-encode.
Convert CSRF token to hex
Some APIs require token in hexadecimal instead of raw. Use Encoder to convert.
Paste token string → Hex encode → use hex value in request.
Decompress gzipped response
Some servers gzip responses. View raw content by decompressing.
Copy gzipped blob (from raw response view) → Gzip decompress → view clear text.
Chaining Encodings
Some payloads are encoded multiple times. The chain feature lets you apply several encodings in sequence:
Tip