What Is This String? Magic Decoder
Identify and decode an unknown string, with the most likely format first.
Use via API
Identify and decode an unknown string: Base64, Base32, hex, URL/percent encoding, JWTs, Unix timestamps, UUIDs, HTML entities, binary, Morse, ROT13, punycode, IP addresses and more. Returns matches ranked by confidence. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/magic-decoder
curl https://pithlab.com/api/v1/tools/magic-decoder \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"SGVsbG8sIFdvcmxkIQ=="}'About the Magic Decoder
Paste any mystery string to identify and decode it: JWT, Base64, hex, URL encoding, HTML entities, timestamps, UUIDs, IPs, colours, cron, Morse and more.
How to use the Magic Decoder
- Paste the string you want to identify, such as a token, an ID, a number or some garbled text.
- Every format the string could be is shown as a card, ranked from most to least likely.
- Each card shows the decoded value, the facts found and why it matched.
- Copy a result, or open the linked tool to work with that format in more depth.
Examples
Input
SGVsbG8sIFdvcmxkIQ==
Output
Base64: Hello, World!
Input
1700000000
Output
Unix timestamp: 2023-11-14T22:13:20.000Z
Input
xn--mnchen-3ya.de
Output
Punycode domain (IDN): münchen.de
Frequently asked questions
Which formats can it recognise?
JWTs, JSON, UUIDs, Unix timestamps, IPv4 and IPv6 addresses, colours, cron expressions, Base64 and Base64url, hex, binary bytes, URL encoding, HTML entities, quoted-printable, Punycode domains, Morse code and ROT13.
How is the ranking decided?
Each detector gives a confidence score. Strict formats like JWTs or UUIDs score high, while strings that fit many formats, like abcd, which is valid hex and Base64, score lower and show further down.
Why does a short word match nothing?
Detectors are tuned to avoid false alarms on plain text. Base64 or hex that would decode to random bytes from an ordinary word is ignored, and normal English sentences produce no matches.
Is the JWT signature checked?
No. The header and payload are decoded so you can read them, but the signature is not verified. Never trust a token's claims without checking it on your server.
Is my string sent anywhere?
No. Every detector runs in your browser, so tokens, IDs and other secrets you paste never leave your device.