Free tool Runs in your browser
Take the wrapping off. Read the token.
Paste something encoded and the layers come off one at a time: base64, base32, hex, percent encoding, HTML entities, quoted printable, and gzip or zlib underneath any of them. You see what it was wrapped in as well as what was inside, and a JSON Web Token is decoded and inspected whole: its header, its claims and whether its secret is guessable.
Encoded blobs in an investigation are evidence, and they usually carry the names of your own systems and people. Everything here is decoded in the page, with the browser's own decompression, and nothing is uploaded.
Paste and unwrap
The blob
Layers are removed until nothing recognisable is left, so a base64 string holding gzip holding JSON comes out as JSON, with the route shown.
Why things are wrapped
Encoding is not encryption, and it is not innocent either.
It hides things from filters
A payload that reads as a harmless string gets past a rule that looks for the obvious words. Layers exist because one layer is often enough to defeat a pattern match, and nobody checks twice.
It hides things from readers
A command line argument, a scheduled task, a registry value: encoding makes the interesting part invisible to whoever is scrolling through the log.
Most of it is ordinary
Every session token, tracking parameter and email attachment is encoded for entirely dull reasons. Encoding by itself proves nothing, which is why what falls out matters more than the fact it was wrapped.
Compression under encoding
A gzip stream inside base64 is how larger payloads travel in a URL or a header. Your browser can decompress it, so this page does, without sending it anywhere.
Now find what it points at.
The thing that falls out usually contains addresses, domains and hashes worth collecting, or a link worth taking apart.
More free tools
- checkYourDomainSecSee what the internet already knows about your domain.
- Phishing & email analyzerRead a suspicious email: auth, links and indicators.
- Web response analyzerGrade security headers, evaluate CSP, and read the certificate.
- Static file analysisRead a file's format, hashes, PE internals and hidden content, all in your browser.