Arsenly
Tools
Recon & Discovery16 tools Web Security Audit10 tools Exploitation & OOB3 tools Payloads & Wordlists4 tools Cryptography & Generators3 tools Encoders & Converters5 tools Reference & Reports4 tools
Browse the full catalogue Open /explore →
Free Tools
Recon & Discovery
SiteMapper ProTurn a URL list into 4 views: hierarchical host/path tree, sortable fl… URL & Endpoint ExtractorMine URLs, JS endpoints, domains and parameters from pasted source cod… CIDR / IP CalculatorIPv4 and IPv6 subnet math. Expand CIDRs, parse ranges and netmasks, ag…
Web Security Audit
Cookie / JWT AuditorAudit cookie flags (Secure, HttpOnly, SameSite, __Host- / __Secure- pr… OpenAPI / Swagger AnalyzerPaste or drop an OpenAPI 3 / Swagger 2 spec and map its attack surface…
Cryptography & Generators
Hash ToolkitGenerate (MD5, NTLM, SHA) and identify 60+ hash types with ranked cand… Test Data GeneratorRealistic-looking test data across 22 countries: names, emails, phone … Code / Password / Token GeneratorCustom-charset strings (1-512 chars, up to 5000 at a time), passwords …
Encoders & Converters
Encoder / Decoder4-tab workbench: 20+ encodings (URL, double-URL, percent-all, Base64, … HTTP Request ConverterConvert HTTP requests between 6 formats: Raw HTTP (Burp), curl, fetch(… JSON WorkbenchFormat, validate (with line / col error), minify, sort keys, unescape … Text Suite7-tab text workbench: regex find/replace, sort/dedupe/sample, keep-dro… Text Comparer4-tab diff workbench: true LCS line / word / char diff, side-by-side, …
See all 13 free tools on /explore →
Pricing
Resources
ChangelogWhat's shipped lately API DocsAutomate scans from your CLI About XowiaLabsWho's behind this ContactBug reports, ideas, just say hi Terms & PrivacyAcceptable-use policy + privacy
Sign in Get started
← All tools

Encoder / Decoder

Encoders & Converters Free · No sign-up

4-tab workbench - 20+ encodings (URL/Base64/HTML/JS/CSS/hex/binary/octal/Morse/ROT-N/Atbash) + multi-view (paste once, see every format) + hashing (MD5/SHA family/HMAC) + Unix-timestamp ↔ ISO 8601 conversions.

Try it now No sign-up required. Runs entirely in your browser.
Paste a payload below - the tool encodes it in every format simultaneously. Click Copy on any card. Perfect for picking the right WAF bypass encoding or comparing variants quickly.
Paste text above to see it encoded in every format.
One-way hash functions. MD5 is in pure JS; SHA family + HMAC use the browser’s Web Crypto API (constant-time, sandboxed). For password-cracking lookups, pair with Hash Toolkit.
Two-way Unix timestamp ↔ ISO 8601 ↔ readable formats. Type in any field - the others update live. Useful for token expiry analysis, log correlation, JWT iat / exp conversions.

What is Encoder / Decoder?

Encoder / Decoder is the constant-companion workbench for the format-shifting that fills a bug-bounty / pentest day. Four focused tabs: Encode & Decode (pick from 20+ formats, encode or decode with a click), All encodings (paste a payload once, see it rendered in every format simultaneously - perfect for picking the right WAF bypass), Hash (MD5 + entire SHA family + HMAC variants), Date / Time (Unix-timestamp ↔ ISO 8601 ↔ local time with live conversion).

Coverage favours bug-bounty reality: three URL-encoding variants (standard, percent-encode-all, double-encoded for WAF bypass), three HTML-entity styles (named, decimal, hex), JavaScript string escapes both \xXX and \uXXXX, CSS escape, binary / octal / decimal byte arrays, plus the cipher / obfuscation classics (ROT13, ROT-N with shift, Atbash, Morse).

Hashing covers everything the modern stack uses: MD5 (RFC 1321 pure-JS implementation verified against the spec test vectors), SHA-1, SHA-256, SHA-384, SHA-512 (Web Crypto API), and HMAC-SHA-256 / HMAC-SHA-512 with arbitrary key (verified against RFC 4231). "Hash with all algorithms" produces every digest simultaneously.

100% client-side. Pasted payloads, secrets, sensitive timestamps never leave the browser.

Formats supported

  • URL - encodeURIComponent semantics, percent-encode all chars (every byte as %XX for WAF evasion), and double-encoded (canonical WAF bypass).
  • Base64 - standard + URL-safe (no padding, -/_ for +//).
  • HTML entities - three flavours: named (&), decimal (A), hex (A). Decoder handles all three plus mixed input.
  • JavaScript - \xXX for non-printable (printable as-is), \uXXXX for every char.
  • CSS escape - \41 \20 hex escape format.
  • Numeric - hex (with optional 0x prefix), 8-bit binary, octal, ASCII decimal - all space-separated for readability.
  • Cipher / obfuscation - ROT13, ROT-N (Caesar with arbitrary shift), Atbash, reverse string, full Morse code (with all punctuation).
  • All-encodings multi-view - paste once, see the input rendered in every supported format simultaneously, each in its own copyable card. Killer feature for picking the right WAF bypass.
  • Hash family - MD5 (pure-JS, RFC 1321 verified), SHA-1 / SHA-256 / SHA-384 / SHA-512 (Web Crypto), HMAC-SHA-256 / HMAC-SHA-512 with key (RFC 4231 verified). "Hash with all algorithms" button.
  • Date / Time - live conversion across Unix-seconds ↔ Unix-milliseconds ↔ ISO 8601 UTC ↔ local time. Quick offset buttons (−1 day / −1 h / +1 h / +1 day / +1 week / +30 days). Plus relative time, day of week, timezone offset.
  • Swap / live mode - swap output to input (chain encodings), or enable live mode for as-you-type encoding.
  • Client-side only - no network calls, no telemetry on input.

Where it fits in your workflow

  • →Encode a payload through WAF-bypass URL variants (percent-encode-all + double-encoded) to find one that slips through.
  • →Paste a captured token into All encodings - spot whether it’s Base64 (decode preview), hex (looks-like-hash), or already plain text.
  • →Hash a candidate password with MD5/SHA-1/SHA-256/SHA-512 to feed into Hash Toolkit identification and / or hashcat attacks.
  • →Convert a JWT’s iat / exp claims to readable timestamps to spot expiry-window bugs.
  • →Chain encodings: encode → Swap → encode again to build composite WAF bypasses without copy-paste.
Want more?

This one is free in your browser. Sign up for server-side recon, scan history, and projects.

Create free account Sign in

At a glance

CategoryEncoders & Converters
RunsIn your browser
Token cost Free - no tokens
Access No login needed
Status● Live

Frequently asked questions

How accurate is the MD5 implementation?

Pure-JS port of the RFC 1321 algorithm, verified against the spec’s test vectors: empty string → d41d8cd98f00b204e9800998ecf8427e, "a" → 0cc175b9c0f1b6a831c399e269772661, "abc" → 900150983cd24fb0d6963f7d28e17f72, etc. All four canonical test vectors pass exactly.

Why are SHA hashes from Web Crypto?

The browser’s Web Crypto API gives constant-time, audited, hardware-accelerated implementations of SHA-1 through SHA-512 and HMAC. We use it directly; what you see is what every browser-based crypto pipeline uses.

Does anything go to the server?

No. 100% client-side. The encoder, decoder, hashes and date conversions all run in your browser. Pasted text never touches our infrastructure.

Can I chain encodings?

Yes. Click Swap to move the output to the input, then encode again. The "live" toggle is also useful for chained workflows - flip formats and see results without re-clicking.

Other free tools you might like

Code / Password / Token Generator

Custom-charset strings (1-512 chars, up to 5000 at a time), passwords with entropy scoring, preset tokens (UUID v4, ULID, hex, base64, JWT secrets, Stripe / Slack / GitHub / AWS-style API keys, Luhn-valid test cards) and bulk numeric ranges.
HTTP Request Converter

Convert HTTP requests between 6 formats: Raw HTTP (Burp), curl, fetch(), HAR, JSON spec and form / query string. Auto-detects input, handles full shell quoting, JSON bodies, multi-line curl and HAR entries from DevTools.
Test Data Generator

Realistic-looking test data across 22 countries: names, emails, phone numbers (fiction-reserved ranges), addresses, postal codes and format-valid sample IDs. Safety-reserved ranges so values look real but never collide with live data. Cards, text, JSON and CSV export.
Explore more tools →