How does the encoding detection work?

Detection combines four kinds of checks for every format: Character set — Hex requires only 0–9/A–F; Base58 excludes 0, O, I and l; Base32 requires uppercase A–Z/2–7. Length rules — Base64 lengths must be divisible by 4 (with padding), Base32 by 8; even character counts suggest hex. Padding & framing — correctly placed = padding strongly implies Base64/Base32; <~ ~> delimiters imply Adobe ASCII85. Known shapes — strings starting with eyJ look like JWT headers; 26–35 character strings starting with 1 or 3 look like Bitcoin addresses; 40/64/96/128-character lowercase hex matches SHA digest lengths. The results are weighted into a confidence score and ranked. A decoded preview confirms whether a candidate actually produces readable output.

What are the limits of the detection?

A few honest caveats: Base58Check checksums are not verified — shape matching flags Bitcoin-style addresses, but cryptographic validation lives in the Base58 tool . Very long inputs skip the Base58 deep decode (it is computationally expensive) and fall back to charset-only scoring. Double-encoded strings decode one layer at a time — %2520 becomes %20 , not a space. Re-run the result if it still looks encoded. Exotic variants such as Z85, RFC 1924, or Base32Hex are detected as their parent family where alphabets overlap.

Is the Encoding Detective free and private?

Yes. All detection and decoding run locally in your browser with plain JavaScript — there is no server round-trip, no upload, no logging, and no tracking of your input. Paste freely: config-file tokens, database values, and log excerpts never leave your device.

Encoding Detective — Identify Any Encoded String

Paste any string and instantly see which encoding it likely is — Hex, Base64, Base64URL, Base32, Base58, ASCII85, URL percent-encoding, or plain text — ranked by confidence, with a decoded preview.

Mystery string

Detection runs live in your browser. Nothing is uploaded. Whitespace is ignored; a dropped file's text content is analyzed.

Not sure what you have? Paste it above. The detective checks each format's alphabet, length rules, padding, and whether the decode produces readable output — then ranks the candidates.

What is Encoding Detective — Identify Any Encoded String?

The Encoding Detective identifies which encoding an unknown string uses. Paste anything — a hash-looking hex blob, a JWT segment, a TOTP secret, a crypto address, a percent-escaped URL — and get ranked candidates with the reasoning behind each score.

Eight formats — Hex, Base64, Base64URL, Base32, Base58, ASCII85 (Adobe), URL percent-encoding, and plain UTF-8 text.

Transparent scoring — every candidate lists its evidence: charset matches, length divisibility, padding correctness, known shapes (Bitcoin addresses, IPFS CIDs, JWT headers, SHA digest lengths).

Decoded preview — see what each candidate decodes to before committing to a format.

Ranked confidence — formats are ordered by how well the input fits their rules, not by guesswork.

Zero-Server Tool Data Guarantee

All detection and decoding runs locally in your browser using JavaScript only. Your input never leaves your device — no server upload, no logging, no tracking.

How to Use

Paste the unknown string

Type, paste, or drop a text file. Analysis updates automatically after a short pause.

Read the best guess

The top result has the highest confidence based on alphabet, length, padding, and known-shape checks.

Inspect the evidence

Each candidate explains why it scored as it did — charset matches, length rules, padding, or famous prefixes.

Check the decoded preview

See what each candidate decodes to. Readable output confirms the match; binary output shows a hex dump.

Open the matching tool

Follow the deep link to the full encoder/decoder for the identified format.

Common Use Cases

Identify a mystery string

Found an opaque token in a config file, database row, or log line? Get ranked guesses with evidence in seconds.

Debug JWT fragments

Recognize base64url JWT header segments via the eyJ prefix and preview the decoded JSON claims.

Classify blockchain identifiers

Distinguish legacy Bitcoin addresses, WIF private keys, and IPFS CIDv0 hashes by their Base58 shape.

Recognize hash digests

Spot SHA-1/256/384/512 hex digests by their canonical 40/64/96/128-character lengths.

Recover TOTP secrets

Confirm that an uppercase A–Z2–7 string is RFC 4648 Base32 before feeding it to an authenticator app.

Implementation Examples

JavaScriptCharset & structure checks (no library)

// Quick encoding fingerprint in plain JavaScript
function detectEncoding(input) {
  const s = input.trim();

  if (/^%[0-9a-fA-F]{2}(%[0-9a-fA-F]{2})*$/.test(s)) return 'url-encoded';

  if (/^[0-9a-fA-F]+$/.test(s) && s.length % 2 === 0 && s.length >= 2) {
    return 'hex';
  }

  const b64 = /^[A-Za-z0-9+/]+={0,2}$/.test(s);
  if (b64 && s.length % 4 !== 1) return 'base64';

  const b64url = /^[A-Za-z0-9_-]+={0,2}$/.test(s);
  if (b64url && s.length % 4 !== 1) return 'base64url';

  if (/^[A-Z2-7]+=*$/.test(s) && ![1, 3, 6].includes(s.replace(/=/g, '').length % 8)) {
    return 'base32';
  }

  if (/^[1-9A-HJ-NP-Za-km-z]+$/.test(s)) return 'base58 (or a plain word)';

  return 'unknown / plain text';
}

console.log(detectEncoding('SGVsbG8='));        // base64
console.log(detectEncoding('48656c6c6f'));      // hex
console.log(detectEncoding('JBSWY3DPEHPK3PXP'));// base32

How the detective tells formats apart

Format	Strongest signal
Hex	Even length, 0–9/A–F only, digest lengths 40/64/96/128
Base64	= padding, length divisible by 4, '+'/'/' alphabet
Base64URL	'-'/'_' alphabet, unpadded, eyJ prefix for JWTs
Base32	Uppercase A–Z/2–7, legal lengths mod 8, '=' to 8-char blocks
Base58	No 0/O/I/l, address shapes (1…/3…, Qm…, K/L…)
ASCII85	<~ ~> delimiters, chars '!'–'u' only
URL-encoded	%XX sequences that decode to readable text
Plain text	Natural spacing and language, no structural fit

Production Best Practices & Security

Trust structure over charset — many alphabets overlap (a lowercase word without 0/O/I/l also fits Base58). Length divisibility and padding are the stronger signals. Why:charset alone cannot distinguish overlapping encodings.

Check the decoded preview — a high-confidence match that decodes to garbage is still wrong. Why:real encodings of real data usually produce readable text, images, or structured bytes.

Use delimiters when available — <~ ~> for ASCII85 or data:image/png;base64, make a format near-certain. Why:explicit framing removes ambiguity.

Verify checksums separately — the detective flags Bitcoin address shapes but does not verify Base58Check checksums. Use the Base58 tool for that.

Mind double-encoding — %2520 decodes to %20, not a space. Decode one layer at a time and re-check.

Frequently Asked Questions

The Encoding Detective identifies which encoding an unknown string uses. Paste any text — a hash-looking hex blob, a JWT segment, a TOTP secret, a crypto address, or a percent-escaped URL — and the tool ranks the likely candidates: Hex, Base64, Base64URL, Base32, Base58, ASCII85, URL percent-encoding, and plain UTF-8 text.

Each candidate comes with a confidence score, the evidence behind it, and a live decoded preview so you can verify the match before opening the full tool.

Detection combines four kinds of checks for every format:

Character set — Hex requires only 0–9/A–F; Base58 excludes 0, O, I and l; Base32 requires uppercase A–Z/2–7.
Length rules — Base64 lengths must be divisible by 4 (with padding), Base32 by 8; even character counts suggest hex.
Padding & framing — correctly placed = padding strongly implies Base64/Base32; <~ ~> delimiters imply Adobe ASCII85.
Known shapes — strings starting with eyJ look like JWT headers; 26–35 character strings starting with 1 or 3 look like Bitcoin addresses; 40/64/96/128-character lowercase hex matches SHA digest lengths.

The results are weighted into a confidence score and ranked. A decoded preview confirms whether a candidate actually produces readable output.

Encoding alphabets overlap. Any lowercase English word without the letters 0/O/I/l also fits the Base58 alphabet, and almost all printable punctuation falls inside the ASCII85 range. That is why short or word-like inputs produce multiple candidates with modest scores.

Confidence rises when structure agrees with the charset: correct padding, legal lengths, valid decodes, and recognizable shapes. For genuinely ambiguous inputs the top scores stay moderate on purpose — the detective shows uncertainty instead of guessing.

No. Encoding is reversible with no secret key; encryption requires one. The detective only recognizes encodings. Ciphertext (AES-GCM, ChaCha20 output, etc.) looks like random bytes in some container format — often Base64 — but cannot be decrypted without the key, and this tool will not attempt it.

If the best guess is Base64 and the preview shows binary garbage, you may be looking at ciphertext, compressed data, or an image — try the Base64 tool to decode and inspect the raw bytes.

A few honest caveats:

Base58Check checksums are not verified — shape matching flags Bitcoin-style addresses, but cryptographic validation lives in the Base58 tool.
Very long inputs skip the Base58 deep decode (it is computationally expensive) and fall back to charset-only scoring.
Double-encoded strings decode one layer at a time — %2520 becomes %20, not a space. Re-run the result if it still looks encoded.
Exotic variants such as Z85, RFC 1924, or Base32Hex are detected as their parent family where alphabets overlap.