Classical ciphers (ROT13, Caesar, Atbash, Vigenère), Morse code, the NATO phonetic alphabet and MIME email encodings. The ciphers here are educational — none of them is secure encryption. Everything runs locally in your browser.
Your favourites
Recently used
Start from what you are trying to do
- Inspect a JSON Web TokenA readable view of a token's header and payload, and confidence that its structure is valid.3 steps, starting with JWT Decoder
- Build a token for testingA token you have assembled yourself and then read back to confirm it says what you meant.2 steps, starting with JWT Encoder
- Break or check a simple cipherPlaintext from a classical cipher, or confirmation of which one was used.4 steps, starting with ROT13 Encoder and Decoder
Cipher and Communication Tools
- ROT13 Encoder and DecoderApply ROT13, ROT13.5 or ROT47 – letter rotations used to hide spoilers and puzzle answers from casual reading.
- Caesar Cipher Encoder and DecoderShift letters by any amount from 1 to 25, or break an unknown Caesar cipher instantly by showing all 25 possible shifts at once.
- Atbash CipherApply the Atbash substitution, which mirrors the alphabet so A becomes Z and B becomes Y.
- Vigenere Cipher Encoder and DecoderEncrypt or decrypt with a repeating keyword, the classic polyalphabetic cipher.
- Morse Code TranslatorTranslate text to international Morse code and back, covering letters, digits and common punctuation, with configurable word separators.
- NATO Phonetic Alphabet ConverterSpell text out in the ICAO and NATO phonetic alphabet – Alfa, Bravo, Charlie – for reading codes aloud over phone or radio, and convert phonetic words back to text.
- Quoted-Printable EncoderEncode text as quoted-printable (RFC 2045), the email transfer encoding that keeps mostly-ASCII text readable while escaping everything else.
- Quoted-Printable DecoderDecode a quoted-printable email body back to readable text, resolving the escapes and removing soft line breaks.
- MIME Header Encoder and DecoderDecode encoded words from email Subject and From headers, or build your own – the RFC 2047 mechanism that lets ASCII-only headers carry any language.
JWT and Token Tools
- JWT DecoderDecode a JSON Web Token to inspect its header and payload, with registered claims explained and timestamps converted to dates.
- JWT Structure ValidatorCheck a JWT for structural problems – section count, Base64URL validity, JSON shape, the required alg field, claim types, expiry and the dangerous alg none case.
- JWT EncoderBuild and sign a demonstration JWT locally with HS256, HS384 or HS512.
Frequently asked questions
Are these ciphers secure?
No, and none is offered as security. Caesar, Atbash, ROT13 and Vigenère are classical substitution ciphers, breakable by hand or by frequency analysis in minutes. They are here for puzzles, teaching and hiding a spoiler.
What is ROT13 actually for?
Hiding text from casual reading — a punchline, a spoiler, an answer — where the point is that it takes a deliberate act to reveal it. It is its own inverse, so the same operation encodes and decodes.
How is Vigenère different from Caesar?
Caesar shifts every letter by the same amount, so one guess breaks it. Vigenère shifts by a repeating keyword, which defeats simple frequency analysis but falls to methods that find the key length. It held up for centuries and does not now.
What is Morse code used for today?
Amateur radio, aviation navigation beacons and emergency signalling, because it survives conditions that defeat voice. It is also a good teaching example of a variable-length encoding, where common letters get short codes.
What is the NATO phonetic alphabet for?
Spelling letters unambiguously over a noisy channel, where B and D or M and N are easily confused. Alfa, Bravo, Charlie were chosen to stay distinct under distortion and across accents.
What should I use if I need real encryption?
A vetted implementation of a modern algorithm — AES-GCM or ChaCha20-Poly1305 — with proper key management, through a library rather than by hand. Encryption implemented by hand fails in ways that are not visible from the output.
Does the text I paste leave the browser?
No. Everything is transformed locally, which is worth knowing even for a puzzle, and essential if you are decoding something you were sent.
