Introduction
Staring at a string of gibberish and wondering which decoder to reach for? The multidecoder skips the guessing. Paste any encoded or encrypted text and it runs Base64, Base32, binary, hexadecimal, ROT13, ROT47, Caesar (all 25 shifts), Atbash, Morse code, URL decoding, HTML entities, A1Z26, and reversed text in a single pass. Every method that plausibly applies to your input gets tried, and results are ranked by an English readability score so the most likely decode floats to the top. Nothing leaves your browser. Paste your text below to see every candidate at once.
What this tool does
- Detects and applies 13 decoding methods simultaneously against a single input.
- Checks each method for applicability before running it, so Base64 is only tried on Base64-shaped strings, Morse on dot-dash patterns, and so on.
- Scores every output from 0 to 100 using printable-character ratio, letter frequency, and common English word matches.
- Brute-forces all 25 Caesar shifts and surfaces the one with the highest readability score.
- Runs entirely client-side. No input is sent to any server, which matters when the paste contains private keys or internal identifiers.
How this tool works
The multidecoder runs a two-stage pipeline for each method. First, an applicability check inspects the input string for the structural signature of that encoding. Base64 requires the character set `[A-Za-z0-9+/]` plus optional `=` padding, with a length divisible by 4. Binary needs only `0` and `1` in multiples of 8 bits. Morse looks for dots, dashes, and word separators. Hex accepts `[0-9a-fA-F]` in even-length runs.
If the check passes, the decoder runs and the output is scored. The scoring function counts printable ASCII characters, alphabetic characters, and matches against a set of 80 common English words like "the," "and," "cipher," and "message." Outputs with more than 10% control characters are rejected outright, since those almost always indicate a wrong decode. Results with a score of 60 or above are tagged "Likely." Scores between 30 and 60 are "Possible." Everything else is "Unlikely" but still shown, because low-scoring decodes can still be correct for non-English text or short inputs.
Methods that do not apply to the input are hidden from the results view. If you paste pure binary, the Morse and Base64 rows will not appear. This keeps the output focused on candidates that had a real chance of succeeding.
How the cipher or encoding works
Every encoding has structural rules that a decoder can check before attempting a full decode. RFC 4648 defines Base64, Base32, and Base16 with fixed alphabets and padding rules. Base64 uses 64 characters and produces output 33% longer than the input bytes. Base32 uses 32 characters and produces output 60% longer. Both pad to specific boundaries with `=` characters.
Binary encoding maps each byte to 8 bits under UTF-8, the dominant web encoding. Hexadecimal represents each byte as two characters from `0-9a-fA-F]`. URL encoding, defined in [RFC 3986, uses percent-sign sequences like `%20` for spaces. HTML entities use named references like `&` or numeric references like `A`.
The classical ciphers work differently. They transform letters rather than bytes. ROT13 rotates each letter by 13 positions and is its own inverse. ROT47 rotates all printable ASCII characters (codes 33 to 126) by 47 positions. The Caesar cipher rotates by a fixed shift, and with only 25 non-trivial shifts, brute-forcing all of them takes milliseconds. Atbash mirrors the alphabet: A maps to Z, B to Y, and so on. Morse code, standardized in ITU-R M.1677-1, encodes characters as dot-dash sequences separated by spaces. A1Z26 maps each letter to its alphabetical position (A=1, B=2, through Z=26).
The multidecoder does not identify the cipher type and stop there. It actually decodes with every applicable method and shows you the text. This is the difference between a cipher identifier and a multidecoder: identification tells you what it is, while multidecoding tells you what it says.
How to use this tool
- Paste your encoded or encrypted text into the input field above.
- The tool automatically checks which of the 13 methods could apply to your input based on character set and length constraints.
- Review the ranked results. The top entry has the highest readability score and is the most likely correct decode.
- Click the copy icon next to any result to copy it to your clipboard.
- If no method scores above 30, the input may use a cipher the multidecoder does not cover. Try the dedicated Cipher Identifier or a specific tool from the directory.
Real-world examples
CTF challenge with unknown encoding
A capture-the-flag challenge hands you the string `SYNT{pnrfne_pvcure}`. You paste it into the multidecoder. ROT13 applies because the input is alphabetic, and the output reads `FLAG{caesar_cipher}` with a readability score of 85. The Caesar brute-force row also appears but ROT13 wins because shift 13 is the correct decode. Total time from paste to answer: under one second.
Decoding a Base64 JWT fragment
A developer finds `ZW1haWw6dXNlckBleGFtcGxlLmNvbQ==` in a network capture and does not recognise the encoding. The multidecoder detects the Base64 signature (alphanumeric plus `+` and `/`, length divisible by 4, trailing `==` padding) and decodes it to `email:user@example.com` with a score of 78. The developer copies the result without needing to know in advance that it was Base64.
Geocaching puzzle with mixed encodings
A geocache description contains `.... . .-.. .-.. ---` which is Morse code for `HELLO`. The multidecoder detects the dot-dash pattern, runs the Morse decoder, and returns `HELLO` with a score of 72. The same input would not trigger the Base64 or binary decoders because it fails their character-set checks, so the results list stays clean and focused on the one method that applied.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| Base64 | O(n) byte mapping, RFC 4648 | Email attachments, JWTs, data URIs |
| Base32 | O(n) byte mapping, RFC 4648 | TOTP secrets, DNSSEC, case-insensitive systems |
| Caesar brute force | O(25 * n) for all shifts | Puzzles, CTF warmups, educational exercises |
| Morse code | O(n) token lookup, ITU-R M.1677 | Amateur radio, aviation beacons, puzzles |
| A1Z26 | O(n) number-to-letter mapping | Escape rooms, classroom exercises, simple puzzles |
Limitations or considerations
The multidecoder tries 13 methods. It does not cover polyalphabetic ciphers like Vigenere, transposition ciphers like rail fence, or modern encryption like AES. Those require keys or parameters that cannot be guessed from the ciphertext alone. The readability scorer is tuned for English text. Inputs in other languages or non-text formats (images, binary files) will score low even when decoded correctly. Very short inputs under 4 characters produce unreliable scores because there is not enough data for frequency analysis. For those cases, use the dedicated tool for the encoding you suspect.
Frequently asked questions
What is the difference between a multidecoder and a cipher identifier?
A cipher identifier analyzes your input and tells you which encoding or cipher was likely used. A multidecoder goes further: it actually decodes the input with every applicable method and shows you the resulting text. The identifier answers "what is this?" while the multidecoder answers "what does this say?" You can use both together: run the identifier first to narrow down the type, then use the multidecoder or a dedicated tool for the actual decode.
Why does the multidecoder not try Vigenere or AES?
Vigenere requires a keyword that cannot be recovered from ciphertext alone without a separate cracking step. AES requires a key and an IV. The multidecoder only runs methods that need no key or parameter. For Vigenere, use the Vigenere Auto-Solver which performs key-length detection and recovery. For AES, use the AES Encrypt Decrypt tool with your key.
How is the readability score calculated?
The scorer counts printable ASCII characters, alphabetic characters, and matches against a set of 80 common English words. Outputs with more than 10% control characters (bytes below 32 that are not tab, newline, or carriage return) receive a score of 0. The maximum score is 100. Scores above 60 are tagged Likely, 30 to 60 are Possible, and below 30 are Unlikely.
Can the multidecoder handle text that is not English?
The scoring function is tuned for English. Text in other Latin-script languages will still decode correctly but may receive a lower score because the common-word list is English-only. Non-Latin scripts like Cyrillic or CJK will score low even when the decode is correct, because the alphabetic character ratio check expects Latin letters.
Does the multidecoder work on Base64 that has been URL-encoded?
Yes. If the input contains percent-encoded sequences like `%2B` for `+` or `%2F` for `/`, the URL decoder runs first and produces the raw Base64 string. You can then paste that intermediate result back into the multidecoder for a second pass. The tool does not chain decoders automatically because chaining can produce false positives.
Conclusion
The multidecoder is the fastest path from "I have a string" to "I have the answer" when you do not know the encoding. Paste, scan the ranked results, and copy the one that reads like text. When no method scores high enough, switch to the Cipher Identifier for deeper analysis, or browse the full tools directory for a dedicated decoder.