Encoding Tools
Encode and decode various data formats
Encode and decode data in various formats: URL, HTML, and more. Convert between different schemes safely and efficiently in your browser.
All Encoding Tools
HMAC Generator
Generate HMAC signatures with SHA-1, SHA-256, SHA-384, and SHA-512 in hex or base64 output
Unicode Converter
Convert text to and from Unicode escapes, code points, UTF-8 hex bytes, and Unicode normalization forms
TOTP Generator
Generate Time-based One-Time Passwords (2FA codes) from a secret with QR code for authenticator apps
X.509 Certificate Decoder
Decode PEM and DER X.509 certificates to inspect subject, issuer, validity, fingerprints, and extensions
What is in Encoding Tools
Format and identity work that sits close to security: converting Unicode representations, generating time based one time passwords to RFC 6238, computing HMAC signatures, and decoding an X.509 certificate to read its subject, issuer, validity window, subject alternative names and fingerprints.
These are exactly the payloads that should never be pasted into a remote service. A TOTP secret is a long lived credential, an HMAC key signs requests on your behalf, and a certificate reveals your infrastructure. Every tool here computes in the browser using Web Crypto, so none of it is transmitted.
The certificate decoder in particular saves the usual round trip through an OpenSSL command nobody remembers the flags for.
HMAC signing is the other one worth knowing. Webhook providers sign their payloads so you can prove a request really came from them, and being able to compute the expected signature by hand is the quickest way to work out why a verification is failing.
Common questions
Is it safe to paste a TOTP secret here?
+
The computation happens locally in your browser using Web Crypto, so the secret is not transmitted. That said, a TOTP secret is a long lived credential: treat pasting one anywhere as a decision, and prefer a test secret when you are only checking that a flow works.
Which certificate formats does the decoder read?
+
PEM encoded X.509 certificates, the block that begins with BEGIN CERTIFICATE. It reads subject, issuer, validity dates, subject alternative names, key details, extensions and fingerprints.
Which hash algorithms are supported?
+
SHA-256, SHA-384 and SHA-512 through the browser's own Web Crypto implementation, which is the same code path the rest of the platform uses for TLS.