OneTaskBy Tim King · Updated
Multi Decoder
Layered Base64, Percent-Encoding, Hex and Quoted-Printable Decoding, Step by Step
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Multi Decoder works
This multi decoder works out how a string was encoded and unwraps it, layer after layer, until plain text is left. It is built for payloads found in logs, phishing links and suspicious scripts, where data is often wrapped in Base64 inside URL encoding inside something else.
How the multi decoder peels layers
At each step the decoder tries a list of encodings in order and keeps the first one that produces a clean result. It then repeats on the output, up to ten layers deep.
- Percent-encoding, such as
%3Cscript%3E. - HTML entities, both named like
&and numeric likeA. - Backslash escapes,
\x41,Aand\u{1F600}. - Hex, with or without spaces, colons or a 0x prefix.
- Binary, groups of eight 0s and 1s.
- Decimal character codes, such as
72 101 108 108 111. - Base64 and base64url, with or without padding.
- Quoted-printable, as used in email bodies.
A decode only counts if the result is readable UTF-8 text, which stops random words being mistaken for Base64. When a layer turns out to be a file rather than text, such as gzip, PNG or a Windows executable, the decoder names the file type and stops.
The steps table shows the encoding found at each layer and a preview of the result.
FAQ
Why did it stop before reaching readable text?
Either the next layer is binary data such as compressed or encrypted bytes, or it uses an encoding the decoder does not try, such as ROT13 or a custom cipher. Copy the last result into a more specific tool, such as the hex dump viewer for binary data.
Is it safe to decode a malicious payload here?
Yes. Decoding only transforms text in your browser. Nothing is executed, fetched or sent anywhere, so a decoded script or link is shown as plain text for you to read.
Can a normal word be mistaken for Base64?
Rarely. Short words are often valid Base64, but they decode to unreadable bytes, and the decoder rejects any layer that does not produce clean text or a recognised file type.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Base64 Encoder / Decoder
Encode and decode Base64, standard or URL-safe.
URL Encoder / Decoder
Percent-encode and decode URLs, values and form data.
Text To Hex Converter
Convert text to hexadecimal bytes and back again.
HTML Entity Encoder
Escape and unescape HTML entities in any text.
Binary To Text Converter
Text to binary or ASCII codes and back again, UTF-8 aware.