{"name":"encode","intro":"Models hallucinate hashes with complete confidence — a plausible-looking 64 hex characters that is not the SHA-256 of anything. This tool computes them. Hashes, HMACs with constant-time comparison, CRC/Adler checksums, Base64 (standard and URL-safe), hex, URL and HTML escaping, JWT claim inspection and JSON parse/format all live here.","when_to_use":["Any hash, HMAC, checksum, Base64 or URL encoding — never write one from memory.","Verifying a webhook signature or a download: pass `expected` and get a constant-time `matches` instead of eyeballing two hex strings.","Inspecting a JWT's claims without a library (the signature is *not* verified).","Validating, pretty-printing or minifying JSON, with the exact error position when it fails."],"network":false,"related":"[`validate`](/docs/tools/validate) for checksum-verified identifiers and JSON Schema · [`text`](/docs/tools/text) for counting and transforming the text itself · [`random`](/docs/tools/random) for the secrets you are about to hash.","docs_url":"/docs/tools/encode","modes":[{"name":"hash","purpose":"Hash text or bytes with a named algorithm.","description":"Hashes input with `md5`, `sha1`, `sha224`, `sha256`, `sha384`, `sha512`, `sha3_256`, `sha3_512`, `blake2b` or `blake2s`, returning both hex and Base64 digests plus the byte length that was hashed. Input may be text, or raw bytes given as `bytes_base64`/`bytes_hex`. A non-string input is serialised as compact JSON with sorted keys, and that choice is reported in `assumptions` — it is what makes the hash reproducible. Pass `expected` — hex or Base64, any case, or a whole `sha256sum` line — and the response adds `matches`, compared in constant time; a mismatch is still `ok: true`, because it is an answer.","parameters":[{"name":"text","type":"string \\| number \\| integer \\| boolean \\| array \\| object","required":false,"doc":"The input. Non-strings become compact sorted JSON.","default":null},{"name":"algo","type":"string","required":false,"doc":"Digest algorithm.","default":"`sha256`"},{"name":"expected","type":"string","required":false,"doc":"A digest to verify against: hex or Base64, or a `<digest>  <file>` line.","default":null},{"name":"encoding","type":"string","required":false,"doc":"Text encoding before hashing.","default":"`utf-8`"},{"name":"bytes_base64","type":"string","required":false,"doc":"Raw bytes as Base64, instead of `text`.","default":null},{"name":"bytes_hex","type":"string","required":false,"doc":"Raw bytes as hex, instead of `text`.","default":null}],"examples":[{"mode":"hash","text":"hello world"},{"mode":"hash","text":"hello world","algo":"md5"},{"mode":"hash","text":{"b":2,"a":1}},{"mode":"hash","bytes_hex":"deadbeef","algo":"sha1"},{"mode":"hash","text":"abc","expected":"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad  abc.txt"},{"mode":"hash","text":"abd","expected":"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"},{"mode":"hash","text":"hello","algo":"sha999"},{"mode":"hash","bytes_hex":"zzzz"}]},{"name":"hmac","purpose":"Keyed digests, with constant-time verification.","description":"Computes an HMAC over the input with a secret key. Pass `expected` and the response adds `matches`, compared in constant time against both the hex and Base64 forms — the correct way to verify a webhook signature. The key is never echoed back.","parameters":[{"name":"key","type":"string","required":true,"doc":"The secret key.","default":null},{"name":"text","type":"string \\| number \\| integer \\| boolean \\| array \\| object","required":false,"doc":"The message.","default":null},{"name":"algo","type":"string","required":false,"doc":"Digest algorithm.","default":"`sha256`"},{"name":"expected","type":"string","required":false,"doc":"A signature to compare against, in hex or Base64.","default":null},{"name":"key_base64","type":"boolean","required":false,"doc":"Decode `key` from Base64 first.","default":"`false`"}],"examples":[{"mode":"hmac","key":"s3cret","text":"payload-1"},{"mode":"hmac","key":"s3cret","text":"payload-1","expected":"874582d507bf2715cab202a7b899745887fba3a1935da6699029a96c6a82e770"},{"mode":"hmac","key":"s3cret","text":"payload-1","algo":"sha512"},{"mode":"hmac","key":"s3cret","text":"x","algo":"sha999"},{"mode":"hmac","key":"s3cret"}]},{"name":"checksum","purpose":"CRC32 and Adler-32 checksums.","description":"Computes a non-cryptographic checksum — `crc32` or `adler32` — returning the value as an unsigned integer and as eight hex digits. For integrity against corruption, not against tampering; use `hash` or `hmac` for that. With `expected` the response adds `matches`.","parameters":[{"name":"text","type":"string \\| number \\| integer \\| boolean \\| array \\| object","required":false,"doc":"The input.","default":null},{"name":"algo","type":"string","required":false,"doc":"Checksum algorithm.","default":"`crc32`"},{"name":"expected","type":"string","required":false,"doc":"A value to verify against, as hex or the unsigned integer.","default":null},{"name":"bytes_hex","type":"string","required":false,"doc":"Raw bytes as hex, instead of `text`.","default":null}],"examples":[{"mode":"checksum","text":"hello world"},{"mode":"checksum","text":"hello world","algo":"adler32"},{"mode":"checksum","text":"hello world","expected":"0d4a1185"},{"mode":"checksum","text":"hello","algo":"md5"}]},{"name":"base64","purpose":"Base64 encode and decode, standard or URL-safe.","description":"Encodes or decodes Base64. `urlsafe` switches the alphabet to `-_`, and `strip_padding` removes trailing `=`. Decoding re-adds missing padding, detects the URL-safe alphabet automatically, and — when the decoded bytes are not valid UTF-8 — returns hex with a warning rather than mangling them. Decoding standard-alphabet text (`+`, `/`) under `urlsafe: true` is refused rather than quietly decoded anyway.","parameters":[{"name":"action","type":"string","required":false,"doc":"Direction.","default":"`encode`"},{"name":"text","type":"string \\| number \\| integer \\| boolean \\| array \\| object","required":true,"doc":"The text to encode, or the Base64 to decode.","default":null},{"name":"urlsafe","type":"boolean","required":false,"doc":"Use the `-_` alphabet.","default":"`false`"},{"name":"strip_padding","type":"boolean","required":false,"doc":"Drop trailing `=` when encoding.","default":"`false`"}],"examples":[{"mode":"base64","action":"encode","text":"leftbrain ✓"},{"mode":"base64","action":"decode","text":"bGVmdGJyYWluIOKckw=="},{"mode":"base64","action":"encode","text":"sub?a=1&b=2","urlsafe":true,"strip_padding":true},{"mode":"base64","action":"decode","text":"3q2+7w=="},{"mode":"base64","action":"flip","text":"abc"},{"mode":"base64","action":"decode","text":"a"}]},{"name":"hex","purpose":"Hex encode and decode.","description":"Encodes text to lower-case hex, or decodes hex back to text. Spaces and a `0x` prefix are tolerated when decoding. Bytes that are not valid UTF-8 come back as Base64 with a warning rather than as broken text. Note that `decode` is the fallback: any `action` other than `encode` is treated as a decode rather than rejected.","parameters":[{"name":"action","type":"string","required":false,"doc":"Direction.","default":"`encode`"},{"name":"text","type":"string \\| number \\| integer \\| boolean \\| array \\| object","required":true,"doc":"The text to encode, or the hex to decode.","default":null}],"examples":[{"mode":"hex","action":"encode","text":"leftbrain"},{"mode":"hex","action":"decode","text":"6c 65 66 74 62 72 61 69 6e"},{"mode":"hex","action":"decode","text":"zzzz"},{"mode":"hex","action":"decode","text":"abc"}]},{"name":"url","purpose":"Percent-encode and decode URL components.","description":"Percent-encodes a string for use in a URL. By default `/` is preserved, as it should be in a path; pass `plus: true` for the `application/x-www-form-urlencoded` form, where spaces become `+` and `/` is escaped. `safe` overrides which characters survive.","parameters":[{"name":"action","type":"string","required":false,"doc":"Direction.","default":"`encode`"},{"name":"text","type":"string \\| number \\| integer \\| boolean \\| array \\| object","required":true,"doc":"The string to encode or decode.","default":null},{"name":"plus","type":"boolean","required":false,"doc":"Form encoding: spaces become `+`.","default":"`false`"},{"name":"safe","type":"string","required":false,"doc":"Characters left unescaped.","default":"`/` for encode"}],"examples":[{"mode":"url","action":"encode","text":"reports/Q3 2025/summary&final.pdf"},{"mode":"url","action":"encode","text":"reports/Q3 2025/summary&final.pdf","plus":true},{"mode":"url","action":"decode","text":"q%3Dleft%20brain%26page%3D2"},{"mode":"url","action":"flip","text":"abc"}]},{"name":"html","purpose":"Escape and unescape HTML entities.","description":"Escapes `&`, `<`, `>` and — unless `quote` is false — quotes, so a string can be placed in HTML safely. `unescape` reverses it, including named and numeric entities. This is entity escaping, not sanitisation: it does not make untrusted markup safe to render as markup.","parameters":[{"name":"action","type":"string","required":false,"doc":"Direction.","default":"`escape`"},{"name":"text","type":"string \\| number \\| integer \\| boolean \\| array \\| object","required":true,"doc":"The string to escape or unescape.","default":null},{"name":"quote","type":"boolean","required":false,"doc":"Also escape quotes.","default":"`true`"}],"examples":[{"mode":"html","action":"escape","text":"<b class=\"x\">Tom & Jerry</b>"},{"mode":"html","action":"unescape","text":"caf&eacute; &amp; cr&#232;me"},{"mode":"html","action":"flip","text":"abc"}]},{"name":"jwt_decode","purpose":"Read a JWT's header and claims.","description":"Splits a JWT, Base64url-decodes the header and payload, and renders `exp`, `iat` and `nbf` as ISO timestamps with an `expired` flag. The signature is **not** verified — every response says so in `warnings`, and the claims must be treated as untrusted input until something else checks the signature.","parameters":[{"name":"token","type":"string","required":true,"doc":"The JWT.","default":null}],"examples":[{"mode":"jwt_decode","token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQyIiwibmFtZSI6IkFkYSIsImlhdCI6MTY5OTk5NjQwMCwiZXhwIjoxNzAwMDAwMDAwfQ.c2lnbmF0dXJlLW5vdC12ZXJpZmllZA"},{"mode":"jwt_decode","token":"a.b.c"}]},{"name":"json","purpose":"Parse, pretty-print or minify JSON.","description":"`action: parse` validates a JSON string and, when it fails, returns the message with the exact line, column and character offset — as a successful call, because “this JSON is invalid, here” is the answer. A value that arrives already decoded (an MCP client may hand a JSON-looking string over as an object) is re-encoded rather than stringified with Python's repr. `format` and `minify` go the other way, turning a value into indented or compact text, optionally with sorted keys — always as valid JSON, so a value containing `Infinity` or `NaN`, which JSON cannot spell, is refused rather than written as text no strict parser will read back.","parameters":[{"name":"action","type":"string","required":false,"doc":"What to do.","default":"`parse`"},{"name":"text","type":"string \\| number \\| integer \\| boolean \\| array \\| object","required":false,"doc":"The JSON text, for `parse`.","default":null},{"name":"data","type":"string \\| number \\| integer \\| boolean \\| array \\| object","required":false,"doc":"The value to serialise, for `format` and `minify`.","default":null},{"name":"indent","type":"integer","required":false,"doc":"Indent width, for `format`.","default":"2"},{"name":"sort_keys","type":"boolean","required":false,"doc":"Sort object keys on output.","default":"`false`"}],"examples":[{"mode":"json","action":"stringify","data":{"ratio":"Infinity"}},{"mode":"json","action":"parse","text":"{\"a\": 1, \"b\": [2, 3]}"},{"mode":"json","action":"parse","text":"{\"a\": 1,}"},{"mode":"json","action":"format","data":{"b":2,"a":1},"sort_keys":true},{"mode":"json","action":"minify","data":{"a":1,"b":[2,3]}},{"mode":"json","action":"lint","text":"{}"}]}]}