Tools

A set of conversions and generators you'd otherwise keep a website open for (⇧⌘T). Everything runs locally. Many have a one-click path from a request, like Smart Decode on a selected value.

Encode and decode

URL encode / decode, Base64 encode / decode, Base64URL decode, HTML escape / unescape, Unicode unescape, Hex encode / decode, Smart Decode (detect and unwrap layered encodings), and Gzip decompress.

JSON and JWT

JSON format and minify, a dedicated JSON tool, JWT decode, and JWT forge (including alg:none) for testing token handling.

Hashing and crypto

MD5, SHA-1, SHA-256, SHA-512, HMAC-SHA256, and AES encrypt / decrypt in CBC, ECB and GCM modes.

Generators and checks

UUID v4, timestamp ↔ date conversion, a regex tester, a QR-code generator, and out-of-band (OOB) payloads for pentesting.

To compare two captured responses, use Comparer; to decode a request's auth and parameters at a glance, the Summary panel does it automatically.