Encode and decode
Transforms as you type, in the direction you picked. Nothing leaves the browser.
Convert a file to a Base64 Data URI instead
Choose a file or drop it here
5 MB limit • Read locally, never uploadedHash text
All three digests recompute on every keystroke via
crypto.subtle.
Token & UUID Generator
Backed by crypto.getRandomValues().
Output
Live Reference Clock
Ticking now — use it as the “now” for either converter below.
Timestamp → Human Date
Date String → Timestamp
JSON Web Token
Paste a token to read its header and claims. Decoding happens in this tab; nothing is uploaded.
This does not verify the signature. Verification needs the signing key, and a page that checks a key you pasted in beside the token has told you nothing. Treat a decoded payload as a claim, never as proof.
Header
Payload
Claims
| Claim | Value | When |
|---|
What this does, and where it stops
Every transform on this page runs in this tab. The document declares
connect-src 'none', so it cannot make a network request even if
something in it tried to — no upload, no fetch, no analytics. That is the
point of it: people paste API keys, session tokens and customer records into
encoders, and sending any of that to someone else's server is a poor trade.
Hashing
SHA-256, SHA-512 and SHA-1 come from
crypto.subtle.digest — the browser's own implementation, not a
bundled copy of one. All three recompute on every keystroke because they are
fast enough that debouncing would cost more than it saved.
SHA-1 is here because real systems still emit it, and it is labelled collision-broken because it is: do not use it to decide whether two things are the same. HMAC answers a different question from the three above — not "what is the fingerprint of this" but "was this written by someone holding the key" — and is what a webhook signature actually asks.
JWT
The decoder splits on ., Base64URL-decodes the first two
segments, and renders the claims with the three NumericDate ones
(exp, iat, nbf) resolved to a readable
time. It does not verify the signature, and it will not be changed to: see the
notice on that tab.
Generators
UUID v4 and v7 and the password generator all draw from
crypto.getRandomValues. UUID v7 is RFC 9562's time-ordered form,
so a batch sorts into creation order — the property that makes it a better
primary key than v4.
Limits
- 5 MB per file for Base64 encoding. Larger input is refused rather than silently truncated.
- No encryption or decryption. This is a workbench for transforms that are reversible by anyone, plus digests that are not reversible at all — a page that also held your keys would be a different and much riskier tool.
- No signature verification, for the reason given on the JWT tab.
- Hashing is over UTF-8 text. A file's digest is the digest of its decoded text, not of its raw bytes.
- Only the tab and a few display settings travel in a share link. Nothing you type does — not the plaintext, not an HMAC key, not a token.