# Decoder > CatSuite Decoder: how to use and configure auto-detection of JWT, Base64, URL, Hex, HTML Entities and Binary, plus the JWT/JWE inspector and MD5 and SHA hashes. - Language: en - Canonical URL: https://netcattest.com/catsuite/en/docs/modules/decoder - Section: Modules - Updated: 2026-10-06 - Other language (pt-BR): https://netcattest.com/catsuite/docs/modulos/decodificar The **Decoder** is CatSuite's data transformation bench: you paste or send a value from traffic and the module **recognizes the format**, shows the readable content and also **generates and identifies hashes**. It brings together, on a single screen, the **auto-detection** of JWT, Base64, URL, Hex, HTML Entities and Binary, support for **Base64URL** and **Unicode**, dedicated inspectors for **JWT**, **JWT signatures** and **JWE**, and the generation of **MD5, SHA-1, SHA-256 and SHA-512**. This page explains each concept, each option and how to use and configure the Decoder step by step, in the simplest way for someone just getting started. > [!NOTE] > All Decoder processing happens **locally**, on the device itself. Nothing is sent to external servers. Tokens, secrets and pasted text stay inside the app. ## What the Decoder is and what it is for During a test, traffic is full of "scrambled" values: a percent-encoded parameter in the URL, a Base64 cookie, a JWT token in the `Authorization` header, a body with HTML entities, a hexadecimal dump. The Decoder is the tool that **translates** these values back into readable text, and also does the **reverse** (encoding) when you need to build a value to resend. Typical use cases: - Read the contents of a **JWT token** (header and payload) without relying on external sites. - Decode a **Base64** or **Base64URL** parameter or cookie to see what it carries. - Turn **%20**, `<`, **Hex** bytes or **binary** blocks back into text. - **Generate** the hash of a value (MD5, SHA-1, SHA-256, SHA-512) to compare with another. - **Identify** quickly which hash type a captured string is, by its length. - Inspect a **JWE** envelope and find out which encryption algorithms it uses. The Decoder is an **analysis helper**: it does not send requests or change the target. It is the natural companion of the [Interceptor](https://netcattest.com/catsuite/en/docs/modules/interceptor), the [Repeater](https://netcattest.com/catsuite/en/docs/modules/repeater) and the [Browser](https://netcattest.com/catsuite/en/docs/modules/browser), which send chunks of traffic to it. ## Essential Decoder concepts Before you touch the options, it helps to understand the terms on screen. Each concept below maps to a format, a panel or a button in the module. ### Encode and decode **Encoding** turns readable text into a transport format (for example, plain text to Base64). **Decoding** is the opposite: it starts from the transport format and recovers the readable text. In the **FORMATS** panel, a switch chooses between the two modes for the selected format. ### URL (percent-encoding) **URL** encoding replaces special characters with `%XX`. A space becomes `%20`, a `{` brace becomes `%7B`, and so on. It is the format of query parameters and `application/x-www-form-urlencoded` forms. When decoding, the Decoder turns `%20` back into a space and rebuilds the original text. ### Base64 **Base64** represents bytes using 64 printable characters (`A-Z`, `a-z`, `0-9`, `+`, `/`) with `=` padding. It is very common in APIs, cookies, blobs and headers. The Decoder treats the text as UTF-8 bytes when encoding and rebuilds the text when decoding. ### Base64URL **Base64URL** is the **URL-safe** variant: it swaps `+` and `/` for `-` and `_` and usually **drops the `=`** padding. It is the format of the three segments of a **JWT** and of many links and tokens. When encoding to Base64URL, the Decoder removes the `=` padding; when decoding, it restores the needed padding automatically. > [!TIP] > If a value has `-` and `_` instead of `+` and `/`, or does not end in `=`, it is probably **Base64URL**, not standard Base64. ### Hexadecimal **Hexadecimal** (Hex) shows each byte as two digits from `0` to `f`. The Decoder displays the bytes separated by a space, in the `48 65 78` pattern. When decoding, it ignores separators and characters outside `0-9a-f` and rebuilds the bytes two at a time. ### HTML Entities **HTML entities** escape characters with meaning in markup: `<` becomes `<`, `>` becomes `>`, `&` becomes `&`, `"` becomes `"` and `'` becomes `'`. The Decoder converts both ways and also resolves **numeric entities** such as `é` (decimal) and `é` (hexadecimal), which point to **Unicode** code points. ### ASCII / Binary The **ASCII / Binary** format shows each byte as an **8-bit** block (`01001000`), separated by a space. When decoding, the Decoder requires blocks of exactly 8 bits containing only `0` and `1`, and rebuilds the text from them. ### Unicode and UTF-8 The Decoder treats text as **UTF-8** in every conversion. This means accented characters, emoji and any Unicode code point **survive** encoding and decoding Base64, Hex and Binary. There is no separate "Unicode" button: Unicode support is **intrinsic** to the module and, in the case of HTML Entities, it also shows up as the numeric entities `&#...;` and `&#x...;`, which are resolved to the matching Unicode character. ### JWT (JSON Web Token) A **JWT** has three parts separated by a dot: **header**, **payload** and **signature**, each in Base64URL. The **header** states the algorithm (`alg`) and type (`typ`); the **payload** carries the claims (such as `sub`, `exp`, `iat`); the **signature** guarantees integrity. The **JWT Inspector** splits, decodes and formats the first two parts as JSON, converts `exp` into a readable date and lets you **rebuild** the token after editing the payload. > [!IMPORTANT] > The Decoder reads the JWT **locally** and **does not validate the signature** — that would require the key or secret. When you edit the payload and rebuild, the original signature is kept, so the reconstructed token will most likely be **invalid** for the server. ### JWT signatures (algorithm families) The **JWT and signatures** panel reads the `alg` field in the header and classifies the signature into a **family** and a **type**: - **HMAC (HS256/384/512)** — **symmetric** signature: the same shared secret signs and validates. - **RSA (RS256/384/512)** — **asymmetric** signature with PKCS#1 v1.5: the private key signs, the public key validates. - **RSA-PSS (PS256/384/512)** — modern RSA variant with PSS padding, also asymmetric. - **ECDSA (ES256/384/512)** — elliptic curves with a key pair, asymmetric. - **EdDSA** — modern family (usually Ed25519/Ed448), asymmetric. - **none** — header with `alg=none`: the token is **not signed**. ### JWE (JSON Web Encryption) A **compact JWE** has **five** segments: **protected header**, **encrypted key**, **initialization vector (IV)**, **ciphertext** and **authentication tag**. The **JWE Inspector** reads only the **protected header** (the envelope's public metadata) and identifies `alg` (key management), `enc` (content encryption), `zip`, `cty`, `typ` and `kid`. > [!WARNING] > The JWE Inspector **does not decrypt** the payload. Without the right key, the content stays encrypted; the module only shows the envelope. ### Hashes A **hash** is a fixed-size fingerprint of a piece of content. The Decoder **generates** MD5, SHA-1, SHA-256 and SHA-512 from the text (as UTF-8 bytes) and also **identifies** a captured hash by its length in hexadecimal characters: 32 (MD5), 40 (SHA-1), 64 (SHA-256) and 128 (SHA-512). A hash is a one-way street: it is **not reversible**. ### Smart Decode (auto-detection) **Smart Decode** is the module's "magic": you paste a value and it **tries several formats automatically**, showing a card for each plausible detection. It recognizes **JWT**, **JWE**, **URL**, **Base64**, **Base64URL**, **Hex**, **HTML Entities** and **ASCII/Binary**, and only shows a result when it differs from the input and looks **readable** (above 85% printable characters), keeping "garbage" off the screen. ## The Decoder screen: home page, panels and tabs The Decoder opens on a **home page** with the `DECODIFICAR` title and the summary "Analyze strings, tokens and hashes quickly". Six entries branch off from it, each with an icon, a short description and a summary chip on the right. Tap an entry to open its page; on each page, the **DECODIFICAR** shortcut at the top (with the arrow) returns to the home page. | Entry | What it opens | Summary shown | | --- | --- | --- | | FORMATS | Encode and decode URL, Base64, Base64URL, Hex, HTML Entities and ASCII/Binary | The current format (e.g. `URL`) | | JWT INSPECTOR | Split header, payload and signature, convert `exp` and rebuild the token | `JWT` | | JWT AND SIGNATURES | Classify HS/HMAC, RS/RSA, PS/RSA-PSS, ES/ECDSA and symmetric vs. asymmetric | `HS / RS / ES` | | JWE INSPECTOR | Read the protected header and split the 5 segments of the compact JWE | `JWE` | | HASHES AND CRYPTO | Generate MD5, SHA-1, SHA-256, SHA-512 and identify hashes | The current algorithm (e.g. `SHA-256`) | | SMART DECODE | Auto-detection of JWT, Base64, URL, Hex, HTML Entities and Binary | `MÁGICA` | Every page shares the same structure: an **INPUT** field to paste the value, a row of **action buttons** and one or more **RESULT** blocks. The result blocks are **selectable**: press and hold to copy or to send a snippet back to Smart Decode itself. ## Decoder options and how to configure them The Decoder options live on the **FORMATS** and **HASHES AND CRYPTO** pages. The table below gathers them all. | Option | Values | Default | What it does | | --- | --- | --- | --- | | Mode (FORMATS) | DECODE, ENCODE | DECODE | Sets the direction of the conversion for the selected format | | Format | URL, BASE64, BASE64URL, HEXADECIMAL, HTML ENTITIES, ASCII / BINARY | URL | Chooses which transformation is applied to the input | | Algorithm (HASHES) | MD5, SHA-1, SHA-256, SHA-512 | SHA-256 | Chooses the algorithm used by GENERATE HASH | To **configure FORMATS**, start with the **MODE**: leave it on **DECODE** to read a captured value, or switch to **ENCODE** when you want to produce a value to resend. Then tap the chip for the **FORMAT** you want — the description right below explains what that format does. Paste the content into **INPUT** and tap **RUN**. The result appears under **RESULT**; use **USE OUTPUT** to push the result back into the input and **chain** conversions (for example, decode Base64URL and then read the JSON). To **configure HASHES**, tap the **ALGORITHM** chip (MD5, SHA-1, SHA-256 or SHA-512) before generating. Paste the content into **INPUT** and use **GENERATE HASH**. If what you pasted is already a hash and you want to know which one, tap **IDENTIFY**: the module looks at the length in hexadecimal characters and states the likely type. > [!TIP] > The **hash algorithm** only affects the **GENERATE HASH** button. **IDENTIFY** works for any hexadecimal hash, regardless of the algorithm selected in the chips. ## Buttons and actions Each page has its own set of buttons. The table gathers what each one does. | Button | Page | What it does | | --- | --- | --- | | RUN | Formats | Applies the current format and mode to the input | | USE OUTPUT | Formats | Copies the result back into the input field | | COPY | Formats | Copies the result to the clipboard | | ANALYZE | JWT Inspector | Splits and decodes header, payload and signature | | COPY TOKEN | JWT / JWE Inspector | Copies the original token from the input | | REBUILD TOKEN | JWT Inspector | Recreates the token from the edited payload | | COPY REBUILT | JWT Inspector | Copies the reconstructed token | | ANALYZE SIGNATURE | JWT and signatures | Classifies the signature family and type | | USE TOKEN FROM INSPECTOR | JWT and signatures | Brings over the token already pasted in the JWT Inspector | | ANALYZE JWE | JWE Inspector | Splits the 5 segments and reads the protected header | | GENERATE HASH | Hashes and crypto | Generates the hash of the input with the chosen algorithm | | IDENTIFY | Hashes and crypto | States the likely hash type by its length | | COPY HASH | Hashes and crypto | Copies the generated hash | | MÁGICA | Smart Decode | Runs auto-detection over the input | | CLEAR | Smart Decode | Clears the input and the results | | USE AS INPUT | Smart Decode | Uses the text received from traffic as input | | OPEN JWT / OPEN JWE | Smart Decode | Opens the detected token in the matching inspector | ## Step by step ### 1. Decode a simple format value 1. On the home page, open **FORMATS**. 2. Keep the **MODE** on **DECODE**. 3. Choose the **FORMAT** (for example, **BASE64**). 4. Paste the value into **INPUT** and tap **RUN**. 5. Read the **RESULT**. If it is still encoded in another format, tap **USE OUTPUT** and repeat with the next format. ### 2. Encode a value to resend 1. In **FORMATS**, switch the **MODE** to **ENCODE**. 2. Choose the target format (for example, **URL** for a query parameter). 3. Type or paste the readable text into **INPUT** and tap **RUN**. 4. Use **COPY** and take the value to the [Repeater](https://netcattest.com/catsuite/en/docs/modules/repeater) or the [Interceptor](https://netcattest.com/catsuite/en/docs/modules/interceptor). ### 3. Inspect and rebuild a JWT 1. Open the **JWT INSPECTOR** and paste the full token into **JWT TOKEN**. 2. Tap **ANALYZE**. See the colored view (HEADER, PAYLOAD, SIGNATURE), the **HEADER DECODED** block and, if there is an `exp`, the **exp TIMESTAMP** converted to local date. 3. Edit the JSON in **EDITABLE PAYLOAD** if you want to test a variation. 4. Tap **REBUILD TOKEN** and then **COPY REBUILT**. 5. Remember: the old signature is kept, so the rebuilt token tends to be rejected by the server that validates the signature. ### 4. Classify a JWT signature 1. Open **JWT AND SIGNATURES**. If the token is already in the Inspector, tap **USE TOKEN FROM INSPECTOR**; otherwise, paste it into **JWT TOKEN**. 2. Tap **ANALYZE SIGNATURE**. 3. Read the **SIGNATURE SUMMARY** (`ALG`, `TYPE`, `FAMILY`, `typ`) and the **CLASSIFICATION**, which explains the key flow and lists the algorithms in the same family. ### 5. Read a JWE envelope 1. Open the **JWE INSPECTOR** and paste the compact JWE (5 segments) into **JWE TOKEN**. 2. Tap **ANALYZE JWE**. 3. See the **ENVELOPE SUMMARY** (`alg`, `enc`, `zip`, `cty`, `typ`, `kid`), the 5-segment view and the **PROTECTED HEADER DECODED** block. ### 6. Generate and identify hashes 1. Open **HASHES AND CRYPTO**. 2. To generate: choose the **ALGORITHM**, paste the content into **INPUT** and tap **GENERATE HASH**. Use **COPY HASH** to carry the value forward. 3. To identify: paste the hash into **INPUT** and tap **IDENTIFY**. The module responds with the likely type by length. ### 7. Paste or send a value from traffic 1. In the [Interceptor](https://netcattest.com/catsuite/en/docs/modules/interceptor), the [Repeater](https://netcattest.com/catsuite/en/docs/modules/repeater) or any selectable text in the app, **select** the snippet. 2. In the selection menu, tap **DECODE** (or use **Send to Decoder**). The app shows the message "Analysis sent to the Decoder". 3. The Decoder opens **SMART DECODE** with the snippet in **RECEIVED TEXT** and runs auto-detection right away. 4. Tap **USE AS INPUT** to edit and reprocess, or **OPEN JWT** / **OPEN JWE** when a token is detected. 5. In the [Browser](https://netcattest.com/catsuite/en/docs/modules/browser), use **Detect JWT / Base64 in storage** to send tokens and values from the page storage straight here. > [!TIP] > If you prefer, paste the value manually into **MAGIC INPUT** and tap **MÁGICA**. The result is the same as the auto-detection coming from traffic. ## Examples URL decoding (percent-encoding): ```text nome%3DCat%20Suite%26id%3D1024 ``` ```text nome=Cat Suite&id=1024 ``` Base64 and Base64URL with the same content: ```text Q2F0U3VpdGU= ``` ```text CatSuite ``` Hexadecimal in space-separated bytes: ```text 48 65 78 ``` ```text Hex ``` HTML entities, including a numeric Unicode entity: ```text <b>café</b> ``` ```text café ``` Binary blocks of 8 bits: ```text 01001000 01101001 ``` ```text Hi ``` A sample JWT and its first two decoded parts: ```text eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c ``` ```json { "alg": "HS256", "typ": "JWT" } ``` ```json { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 } ``` Hashes of the text `CatSuite` in each algorithm: ```text MD5 08aa3451f325a5ffebb46df10aec9ecf SHA-1 30a1abc0a012cd7a49f469d698d7881df04b201e SHA-256 10f3dfd0bb7f1fb99bbe8fd16816ad6e5ca012be645c2a0660d50a45ecfb7961 SHA-512 1824976bbd707e6d646ff5fbb5ea3d9171d8ba3882d9ef6e81e84c34ea1a52f3ea097123e30420037917cd78bcd3df2f89cd794a3d9faa840330c5ca785aa58f ``` Identification by length in hexadecimal characters: ```text 32 characters -> MD5 40 characters -> SHA-1 64 characters -> SHA-256 128 characters -> SHA-512 ``` ## Common problems and FAQ **I pasted a Base64 and the result came out "dirty" or empty.** It may be **Base64URL** (with `-` and `_`), not standard Base64. Switch the format to **BASE64URL**. Also check that there are no line breaks or stray spaces pasted along; the module strips spaces, but truncated content will not decode. **The Hex does not decode.** The Hex decoder needs an **even** number of hexadecimal digits. Characters outside `0-9a-f` are ignored, but if a lone digit is left over, the conversion fails. Paste the complete bytes. **The Binary gave an error.** Use blocks of exactly **8 bits** containing only `0` and `1`, separated by a space. Any other character invalidates the input. **The JWT does not open.** A JWT needs at least **header and payload** separated by a dot, and both must be valid JSON in Base64URL. Truncated tokens, extra quotes or half-pasted content will not pass. **I edited the payload and the token "broke".** That is expected. The Decoder **keeps the original signature** when rebuilding and **does not sign** again (it has no key). The rebuilt token is for study, not for fooling a server that validates the signature. **The JWE does not show the content.** The JWE Inspector reads **only the envelope** (protected header and segments). The payload stays **encrypted**: without the right key, there is no way to decrypt it. **IDENTIFY said "the length does not match".** The value is hexadecimal, but it is not 32, 40, 64 nor 128 characters. It may be a hash from another algorithm, a truncated value or something that is not a hash. **Smart Decode detected nothing.** It only shows results that **differ from the input** and that look **readable**. A value that is already plain text, or that decodes to unreadable bytes, produces no card. Try the specific format on the **FORMATS** page. > [!DANGER] > The Decoder never validates signatures or decrypts protected content. Do not treat a JWT read here as "trusted" just because the payload opened: local reading **does not prove** the token's authenticity. ## Next step - [Browser](https://netcattest.com/catsuite/en/docs/modules/browser) - [Interceptor](https://netcattest.com/catsuite/en/docs/modules/interceptor) - [Repeater](https://netcattest.com/catsuite/en/docs/modules/repeater) - [Intruder](https://netcattest.com/catsuite/en/docs/modules/intruder) - [SSL/TLS](https://netcattest.com/catsuite/en/docs/modules/ssl-tls) - [Security and responsible use](https://netcattest.com/catsuite/en/docs/security)