PRIVACY · ENCODEKIT
Readable does not mean trustworthy.
Encoding, decoding, JSON formatting, and JWT payload inspection happen in the current browser. But encoding is not encryption, and decoding is not security verification.
Encoding is not protection
Base64, URL percent-encoding, and HTML entities are reversible representations. They provide no confidentiality, authentication, or integrity guarantee. Anyone with the result can decode it, so do not use them to hide passwords, access tokens, or personal information. Decoded HTML entities are shown in a read-only text area and are not executed by this site as arbitrary page script.
Decode-only JWT inspection
EncodeKit parses only the JWT payload segment and displays iat, exp, and nbf time claims. It does not verify the signature, issuer, audience, algorithm, or revocation status. “Time-valid” means only that time fields are not expired under the device clock; it does not make a token authentic, trusted, or still authorized. JWT payloads often contain account or permission data, so redact before sharing.
Workspace and clipboard
Only when you explicitly choose Save or Import are current form fields stored as a local workspace in this browser; you can export it as JSON, restore it from a local JSON file, or clear it at any time. A workspace may contain the full input or JWT, so do not save sensitive tokens on a shared device. Copy result writes to the system clipboard only after a click; EncodeKit does not read the clipboard. Undo history stays only in the current tab.
Display preferences and ads
The site uses .miluland.com domain cookies to sync language, theme, high-contrast preference, and up to 16 favorite tool IDs across MiluLand sites, with a local compatibility copy on the current site. Favorites contain only tool IDs—never inputs, files, or results—and can be cleared from the MiluLand tool directory or browser settings.
This page uses Google AdSense Auto Ads. Third parties may process cookies and ordinary network information under their policies; EncodeKit does not intentionally provide input, output, JWTs, or workspaces to the ad system.
Updated: September 5, 2026
← Back to toolAnalytics and your choices
Google Analytics measures page visits and tool openings. Visitors in the EEA, UK, Switzerland, mainland China, Canada, South Korea, and Türkiye are asked first; other identified regions start automatically. A previous refusal, GPC, or Do Not Track takes precedence. Tools work with either choice.
We use same-site Cloudflare connection information to determine the country or region, not your language, and do not save the IP address in the lookup. If the lookup fails, the Google tag still starts with regional consent defaults: analytics cookies in consent-required regions await permission, while Google may receive basic cookieless signals. Automatic startup is not recorded as your explicit consent.
Files, filenames, tool inputs, search terms, URL parameters, fragments, and results are excluded. Page names use fixed paths and referrers contain only the source site. Google processes visit identifiers and technical browser information. Enhanced measurement, Google signals, and ad-personalization measurement are disabled.
Turn analytics on or off through Privacy & analytics in the footer. Explicit choices are shared across enabled pages in a .miluland.com cookie for up to 180 days; automatic startup does not save an accepted choice. Turning it off stops this integration and clears accessible GA cookies. Advertising uses separate consent settings.