Encoding, cipher and hash tools
Decoders, encoders and hash tools for CTFs, log analysis and everyday debugging. All free, no sign-up, and everything runs in your browser.
Classical ciphers
Puzzle and CTF ciphers. None of them is secure: each falls to brute force or frequency analysis.
Encodings
Ways to represent data, not to hide it. Anyone can reverse them without a key.
- Base64 decode and encodeText, files and images, URL-safe variant, decoded image preview.
- URL encode and decodePercent-encoding for query strings and paths.
- HTML entity encoderEscape and unescape characters such as < > & and named entities.
- Binary translatorBinary to text and text to binary, with decimal and hex views.
- Number base converterBinary, octal, decimal and hex.
- Punycode converterInternationalised domain names to xn-- form and back, useful for spotting look-alike domains.
Hashes, passwords and tokens
One-way functions and signed tokens used in authentication.
- Hash generatorSHA-256, SHA-1, MD5 and more for text or files.
- Hash identifierGuess a hash type from its length and format.
- Bcrypt generatorHash a password with bcrypt and verify one.
- JWT decoderRead a JSON Web Token header, claims and expiry.
- JWT generatorBuild and sign a test token.
- TOTP generatorSix-digit one-time codes from a secret, for testing MFA.
Frequently asked questions
What is the difference between encoding, encryption and hashing?
Encoding (Base64, URL encoding, binary) changes how data is represented so it can be stored or sent; anyone can reverse it. Encryption hides data so only someone with the key can read it; classical ciphers like Caesar and Vigenère are early, broken forms of it. Hashing is one-way: it turns input into a fixed-length fingerprint that cannot be turned back, which is why passwords are stored as hashes (ideally with a slow algorithm such as bcrypt).
Are these tools safe for sensitive data?
They run in your browser: what you paste is processed on your device and is not sent to our servers. Even so, avoid pasting live production secrets or private keys into any web page.
Which cipher tools can solve a message without the key?
The Caesar decoder ranks all 26 shifts by English letter frequency, and the Vigenère decoder estimates the key length and key from the cipher text (it needs roughly 100 letters). ROT13 needs no key at all.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.