Scan an HTML or SVG attachment for hidden payloads, atob/eval chains and off-site forms.
New
Multi-Layer Decoder
Runs locallyNew
Use Multi-Layer Decoder
What it does
Paste encoded or obfuscated text and the decoder peels one layer after another, showing each step, until readable text or a known file format remains. Everything runs in your browser.
It runs entirely in your browser: nothing you enter is uploaded.
Example
URL-encoded Base64 of gzip
H4sIAAAAAAACA7MpTi7KLCixK8%2FMS8kv18vJT04syczP08soSk1TsFVQyigpKSi20tdPrUjMLchJ1UvOz9UvSy3KTKu0L04tLgYqtTVPM05UsrbRh5oEACvqcc1SAAAA3 layers: URL percent-encoding → Base64 → gzip
No further encoding recognised.
1
URL percent-encoding
1 escape · 130 → 128 bytes
H4sIAAAAAAACA7MpTi7KLCixK8/MS8kv18vJT04syczP08soSk1TsFVQyigpKSi20tdPrUjMLchJ1UvOz9UvSy3KTKu0L04tLgYqtTVPM05UsrbRh5oEACvqcc1SAAAA
2
Base64
decodes to gzip · 128 → 96 bytes
00000000 1f 8b 08 00 00 00 00 00 02 03 b3 29 4e 2e ca 2c |...........)N..,|
00000010 28 b1 2b cf cc 4b c9 2f d7 cb c9 4f 4e 2c c9 cc |(.+..K./...ON,..|
00000020 cf d3 cb 28 4a 4d 53 b0 55 50 ca 28 29 29 28 b6 |...(JMS.UP.())(.|
… 48 more bytes
3
gzip
96 → 82 bytes
<script>window.location.href = "hxxps://example[.]com/verify?session=7f3a";</script>
Result
Text, 82 bytes.
<script>window.location.href = "hxxps://example[.]com/verify?session=7f3a";</script>
Indicators in the result (1)
URL
hxxps://example[.]com/verify?session=7f3a
Copy indicators (raw)Three layers: URL percent-encoding (%2F), Base64 that decodes to gzip data, and gzip itself, ending in a script that sends the browser to https://example.com/verify.
FAQ
Which encodings does it recognise?
Base64 (standard and URL-safe, padding optional), hex in plain, 0x, \x, spaced or colon-separated form, URL percent-encoding, HTML entities, \x, \u, \u{…} and %u escapes, String.fromCharCode lists, quoted-printable, gzip, zlib and raw deflate, and UTF-16LE text such as a PowerShell -EncodedCommand. Calls like atob('…') or base64_decode('…') and data: URIs are unwrapped as well.
Why did it stop, or leave my text as it is?
A layer is only accepted when its output is readable text, a known file format or a stream that decompresses cleanly, so ordinary words that happen to be valid Base64 are left alone. Short or unusual encodings can therefore be missed: use Decode as to apply a method by hand and Undo to step back. It stops after 12 layers.
Is the decoded content run or sent anywhere?
No. Decoding uses plain JavaScript and the browser's DecompressionStream; the result is shown as text or as a hex dump and is never executed, rendered or uploaded.