Decoder

The Decoder is CatSuite's data transformation bench: you paste or send a value from traffic and the module recognizes the format, shows the readable content and also generates and identifies hashes. It brings together, on a single screen, the auto-detection of JWT, Base64, URL, Hex, HTML Entities and Binary, support for Base64URL and Unicode, dedicated inspectors for JWT, JWT signatures and JWE, and the generation of MD5, SHA-1, SHA-256 and SHA-512. This page explains each concept, each option and how to use and configure the Decoder step by step, in the simplest way for someone just getting started.

What the Decoder is and what it is for #

During a test, traffic is full of "scrambled" values: a percent-encoded parameter in the URL, a Base64 cookie, a JWT token in the Authorization header, a body with HTML entities, a hexadecimal dump. The Decoder is the tool that translates these values back into readable text, and also does the reverse (encoding) when you need to build a value to resend.

Typical use cases:

• Read the contents of a JWT token (header and payload) without relying on external sites.
• Decode a Base64 or Base64URL parameter or cookie to see what it carries.
• Turn %20, <, Hex bytes or binary blocks back into text.
• Generate the hash of a value (MD5, SHA-1, SHA-256, SHA-512) to compare with another.
• Identify quickly which hash type a captured string is, by its length.
• Inspect a JWE envelope and find out which encryption algorithms it uses.

The Decoder is an analysis helper: it does not send requests or change the target. It is the natural companion of the Interceptor, the Repeater and the Browser, which send chunks of traffic to it.

Essential Decoder concepts #

Before you touch the options, it helps to understand the terms on screen. Each concept below maps to a format, a panel or a button in the module.

Encode and decode #

Encoding turns readable text into a transport format (for example, plain text to Base64). Decoding is the opposite: it starts from the transport format and recovers the readable text. In the FORMATS panel, a switch chooses between the two modes for the selected format.

URL (percent-encoding) #

URL encoding replaces special characters with %XX. A space becomes %20, a { brace becomes %7B, and so on. It is the format of query parameters and application/x-www-form-urlencoded forms. When decoding, the Decoder turns %20 back into a space and rebuilds the original text.

Base64 #

Base64 represents bytes using 64 printable characters (A-Z, a-z, 0-9, +, /) with = padding. It is very common in APIs, cookies, blobs and headers. The Decoder treats the text as UTF-8 bytes when encoding and rebuilds the text when decoding.

Base64URL #

Base64URL is the URL-safe variant: it swaps + and / for - and _ and usually drops the = padding. It is the format of the three segments of a JWT and of many links and tokens. When encoding to Base64URL, the Decoder removes the = padding; when decoding, it restores the needed padding automatically.

Hexadecimal #

Hexadecimal (Hex) shows each byte as two digits from 0 to f. The Decoder displays the bytes separated by a space, in the 48 65 78 pattern. When decoding, it ignores separators and characters outside 0-9a-f and rebuilds the bytes two at a time.

HTML Entities #

HTML entities escape characters with meaning in markup: < becomes <, > becomes >, & becomes &, " becomes " and ' becomes '. The Decoder converts both ways and also resolves numeric entities such as é (decimal) and é (hexadecimal), which point to Unicode code points.

ASCII / Binary #

The ASCII / Binary format shows each byte as an 8-bit block (01001000), separated by a space. When decoding, the Decoder requires blocks of exactly 8 bits containing only 0 and 1, and rebuilds the text from them.

Unicode and UTF-8 #

The Decoder treats text as UTF-8 in every conversion. This means accented characters, emoji and any Unicode code point survive encoding and decoding Base64, Hex and Binary. There is no separate "Unicode" button: Unicode support is intrinsic to the module and, in the case of HTML Entities, it also shows up as the numeric entities &#...; and &#x...;, which are resolved to the matching Unicode character.

JWT (JSON Web Token) #

A JWT has three parts separated by a dot: header, payload and signature, each in Base64URL. The header states the algorithm (alg) and type (typ); the payload carries the claims (such as sub, exp, iat); the signature guarantees integrity. The JWT Inspector splits, decodes and formats the first two parts as JSON, converts exp into a readable date and lets you rebuild the token after editing the payload.

JWT signatures (algorithm families) #

The JWT and signatures panel reads the alg field in the header and classifies the signature into a family and a type:

• HMAC (HS256/384/512) — symmetric signature: the same shared secret signs and validates.
• RSA (RS256/384/512) — asymmetric signature with PKCS#1 v1.5: the private key signs, the public key validates.
• RSA-PSS (PS256/384/512) — modern RSA variant with PSS padding, also asymmetric.
• ECDSA (ES256/384/512) — elliptic curves with a key pair, asymmetric.
• EdDSA — modern family (usually Ed25519/Ed448), asymmetric.
• none — header with alg=none: the token is not signed.

JWE (JSON Web Encryption) #

A compact JWE has five segments: protected header, encrypted key, initialization vector (IV), ciphertext and authentication tag. The JWE Inspector reads only the protected header (the envelope's public metadata) and identifies alg (key management), enc (content encryption), zip, cty, typ and kid.

Hashes #

A hash is a fixed-size fingerprint of a piece of content. The Decoder generates MD5, SHA-1, SHA-256 and SHA-512 from the text (as UTF-8 bytes) and also identifies a captured hash by its length in hexadecimal characters: 32 (MD5), 40 (SHA-1), 64 (SHA-256) and 128 (SHA-512). A hash is a one-way street: it is not reversible.

Smart Decode (auto-detection) #

Smart Decode is the module's "magic": you paste a value and it tries several formats automatically, showing a card for each plausible detection. It recognizes JWT, JWE, URL, Base64, Base64URL, Hex, HTML Entities and ASCII/Binary, and only shows a result when it differs from the input and looks readable (above 85% printable characters), keeping "garbage" off the screen.

The Decoder screen: home page, panels and tabs #

The Decoder opens on a home page with the DECODIFICAR title and the summary "Analyze strings, tokens and hashes quickly". Six entries branch off from it, each with an icon, a short description and a summary chip on the right. Tap an entry to open its page; on each page, the DECODIFICAR shortcut at the top (with the arrow) returns to the home page.

Every page shares the same structure: an INPUT field to paste the value, a row of action buttons and one or more RESULT blocks. The result blocks are selectable: press and hold to copy or to send a snippet back to Smart Decode itself.

Decoder options and how to configure them #

The Decoder options live on the FORMATS and HASHES AND CRYPTO pages. The table below gathers them all.

To configure FORMATS, start with the MODE: leave it on DECODE to read a captured value, or switch to ENCODE when you want to produce a value to resend. Then tap the chip for the FORMAT you want — the description right below explains what that format does. Paste the content into INPUT and tap RUN. The result appears under RESULT; use USE OUTPUT to push the result back into the input and chain conversions (for example, decode Base64URL and then read the JSON).

To configure HASHES, tap the ALGORITHM chip (MD5, SHA-1, SHA-256 or SHA-512) before generating. Paste the content into INPUT and use GENERATE HASH. If what you pasted is already a hash and you want to know which one, tap IDENTIFY: the module looks at the length in hexadecimal characters and states the likely type.

Buttons and actions #

Each page has its own set of buttons. The table gathers what each one does.

Step by step #

1. Decode a simple format value #

1. On the home page, open FORMATS.
2. Keep the MODE on DECODE.
3. Choose the FORMAT (for example, BASE64).
4. Paste the value into INPUT and tap RUN.
5. Read the RESULT. If it is still encoded in another format, tap USE OUTPUT and repeat with the next format.

2. Encode a value to resend #

1. In FORMATS, switch the MODE to ENCODE.
2. Choose the target format (for example, URL for a query parameter).
3. Type or paste the readable text into INPUT and tap RUN.
4. Use COPY and take the value to the Repeater or the Interceptor.

3. Inspect and rebuild a JWT #

1. Open the JWT INSPECTOR and paste the full token into JWT TOKEN.
2. Tap ANALYZE. See the colored view (HEADER, PAYLOAD, SIGNATURE), the HEADER DECODED block and, if there is an exp, the exp TIMESTAMP converted to local date.
3. Edit the JSON in EDITABLE PAYLOAD if you want to test a variation.
4. Tap REBUILD TOKEN and then COPY REBUILT.
5. Remember: the old signature is kept, so the rebuilt token tends to be rejected by the server that validates the signature.

4. Classify a JWT signature #

1. Open JWT AND SIGNATURES. If the token is already in the Inspector, tap USE TOKEN FROM INSPECTOR; otherwise, paste it into JWT TOKEN.
2. Tap ANALYZE SIGNATURE.
3. Read the SIGNATURE SUMMARY (ALG, TYPE, FAMILY, typ) and the CLASSIFICATION, which explains the key flow and lists the algorithms in the same family.

5. Read a JWE envelope #

1. Open the JWE INSPECTOR and paste the compact JWE (5 segments) into JWE TOKEN.
2. Tap ANALYZE JWE.
3. See the ENVELOPE SUMMARY (alg, enc, zip, cty, typ, kid), the 5-segment view and the PROTECTED HEADER DECODED block.

6. Generate and identify hashes #

1. Open HASHES AND CRYPTO.
2. To generate: choose the ALGORITHM, paste the content into INPUT and tap GENERATE HASH. Use COPY HASH to carry the value forward.
3. To identify: paste the hash into INPUT and tap IDENTIFY. The module responds with the likely type by length.

7. Paste or send a value from traffic #

1. In the Interceptor, the Repeater or any selectable text in the app, select the snippet.
2. In the selection menu, tap DECODE (or use Send to Decoder). The app shows the message "Analysis sent to the Decoder".
3. The Decoder opens SMART DECODE with the snippet in RECEIVED TEXT and runs auto-detection right away.
4. Tap USE AS INPUT to edit and reprocess, or OPEN JWT / OPEN JWE when a token is detected.
5. In the Browser, use Detect JWT / Base64 in storage to send tokens and values from the page storage straight here.

Examples #

URL decoding (percent-encoding):

nome%3DCat%20Suite%26id%3D1024

nome=Cat Suite&id=1024

Base64 and Base64URL with the same content:

Q2F0U3VpdGU=

CatSuite

Hexadecimal in space-separated bytes:

48 65 78

Hex

HTML entities, including a numeric Unicode entity:

<b>café</b>

<b>café</b>

Binary blocks of 8 bits:

01001000 01101001

Hi

A sample JWT and its first two decoded parts:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Hashes of the text CatSuite in each algorithm:

MD5      08aa3451f325a5ffebb46df10aec9ecf
SHA-1    30a1abc0a012cd7a49f469d698d7881df04b201e
SHA-256  10f3dfd0bb7f1fb99bbe8fd16816ad6e5ca012be645c2a0660d50a45ecfb7961
SHA-512  1824976bbd707e6d646ff5fbb5ea3d9171d8ba3882d9ef6e81e84c34ea1a52f3ea097123e30420037917cd78bcd3df2f89cd794a3d9faa840330c5ca785aa58f

Identification by length in hexadecimal characters:

32 characters  -> MD5
40 characters  -> SHA-1
64 characters  -> SHA-256
128 characters -> SHA-512

Common problems and FAQ #

I pasted a Base64 and the result came out "dirty" or empty. It may be Base64URL (with - and _), not standard Base64. Switch the format to BASE64URL. Also check that there are no line breaks or stray spaces pasted along; the module strips spaces, but truncated content will not decode.

The Hex does not decode. The Hex decoder needs an even number of hexadecimal digits. Characters outside 0-9a-f are ignored, but if a lone digit is left over, the conversion fails. Paste the complete bytes.

The Binary gave an error. Use blocks of exactly 8 bits containing only 0 and 1, separated by a space. Any other character invalidates the input.

The JWT does not open. A JWT needs at least header and payload separated by a dot, and both must be valid JSON in Base64URL. Truncated tokens, extra quotes or half-pasted content will not pass.

I edited the payload and the token "broke". That is expected. The Decoder keeps the original signature when rebuilding and does not sign again (it has no key). The rebuilt token is for study, not for fooling a server that validates the signature.

The JWE does not show the content. The JWE Inspector reads only the envelope (protected header and segments). The payload stays encrypted: without the right key, there is no way to decrypt it.

IDENTIFY said "the length does not match". The value is hexadecimal, but it is not 32, 40, 64 nor 128 characters. It may be a hash from another algorithm, a truncated value or something that is not a hash.

Smart Decode detected nothing. It only shows results that differ from the input and that look readable. A value that is already plain text, or that decodes to unreadable bytes, produces no card. Try the specific format on the FORMATS page.

Next step #

• Browser
• Interceptor
• Repeater
• Intruder
• SSL/TLS
• Security and responsible use