Decoder Toolbox

MAG212 CYBER · Tools

Decoder toolbox.

Decode and encode Base64, URL and hex, inspect JWT tokens, and defang or refang suspicious links and IP addresses for safe sharing — a lightweight kit for analysts and admins.

Decode / encodeJWT inspectorAnalyst tips

Decode / encode

Base64 URL Hex IOC Text

🔒 Everything runs in your browser. Decoded text is displayed as plain text and never executed.

JWT inspector

Paste a JSON Web Token to read its header and claims. The signature is not verified — never trust a token’s contents without checking its signature on the server.

Analyst tips

  • Defang before sharing. hxxps[://]evil[.]example can’t be clicked by accident in tickets, chats or emails, and won’t be auto-previewed.
  • Phishing links often hide the destination in Base64 or URL-encoded parameters — decode them here instead of clicking.
  • Obfuscated PowerShell frequently uses -EncodedCommand with Base64 of UTF-16LE text; decoded output may show gaps between characters.
  • A JWT with "alg": "none", or a token whose exp is far in the future, deserves a closer look in your application.

Need to check where a link really goes? Use the suspicious link checker.

⚖️ For education and use on systems you own or are authorised to test. Results are automated guidance, not a professional audit. See our terms of use and privacy policy.

Need expert help?

MAG212 CYBER offers network and cybersecurity consultation, plus security seminars for organisations around the world.

Explore our services →