Encode / Decode Workbench

Base64, hex, URL, HTML, Unicode, Base32, quoted-printable, MIME headers, PowerShell -EncodedCommand, gzip/deflate (SAML), punycode, ROT and XOR — auto-detected, chainable and shareable as a link.

Runs entirely in your browser. Your browser blocks this page from opening connections or loading anything from other sites. Nothing you enter is uploaded or saved.

requests since opened: 0
How to verify this yourself
  1. Open your browser’s developer tools (F12, or ⌥⌘I on Mac) → Network tab, then use the tool. No new requests appear.
  2. Or disconnect from the internet after the page loads — the tool keeps working, because it never needed the network.
  3. See the rule itself: in the Network tab, select this page’s document → Response Headers → content-security-policy contains connect-src 'none' and no 'unsafe-inline' for scripts.
  4. Press Test the lock: the page tries a harmless request and the browser blocks it (the Console shows the refusal).
How to use
  1. Paste text. A suggested decode step appears if the format is recognised.
  2. Add steps to chain them (e.g. Base64 → inflate → XML), or press Auto-decode.
  3. Copy the output, or the equivalent shell command to cross-check.

Steps

No steps yet — the output below is your input unchanged.

    Output 0 bytes

    Common questions

    How do I decode a PowerShell -EncodedCommand?

    Paste the whole command line or just the encoded part: it is detected automatically and decoded from Base64 as UTF-16LE, the way PowerShell reads it. This comes up often in incident response.

    What does Auto-decode do?

    It repeatedly detects the encoding and adds the right step — for example Base64, then URL decoding, then raw deflate for a SAML redirect — and stops when nothing more can be decoded.

    What is a look-alike domain?

    A domain that uses letters from other alphabets to imitate a real one, such as a Cyrillic “а” in “аpple.com”. Punycode (xn--) domains are decoded and flagged when they imitate a well-known name.

    Known limitations

    • Text is treated as UTF-8; binary output is shown as hex (the preview stops at 4 KB, copy gives everything).
    • Decompressed output is capped at 50 MB to stop decompression bombs.
    • The look-alike check covers common Cyrillic, Greek and Armenian tricks, not the full Unicode confusables list.
    • Auto-detect is a best guess on short inputs — check the suggested step makes sense.
    • Browser extensions with access to this site can read the page. For sensitive data, use a private window with extensions off. How the lock works

    tools v0.9.0 · build 7317bbb · 2026-10-07

    Related reading on CipherMind

    Standards & references