Decode, transform, hash, filter and convert text by stacking steps — Base64 → gunzip → JSON → JSONPath, or CSV → JSON → filter → Markdown table. Seventy-four operations, instant magic detection of what you pasted, and recipes you can share as a link.
Most developer-tool sites make you decode in one tab, paste into another to format, and into a third to query. Flow keeps the data in one place and lets you stack the operations: every step reads the previous step's output, shows its own result inline, and reports an error without disturbing the steps above it. Change an argument and the whole chain re-runs.
Paste something and Flow guesses what it is — a JWT, gzip inside Base64, percent-encoding, HTML entities, a Unix timestamp, CSV, YAML, a URL, a defanged indicator — and offers the step that opens it. Click the chip and keep going: after a Base64 decode that reveals JSON, the next suggestion is to format or query it.
A recipe is a small JSON document. Copy it, paste it, or share a link that carries both the recipe and the input in the URL fragment — nothing is stored on a server, and the person who opens the link sees the same chain and the same result.
Encoding (Base64, hex, Base32, URL, HTML, Unicode, binary, ROT-N, gzip, JWT), hashing (MD5, SHA family, HMAC, CRC32, per-line digests), text (case, trim, find and replace, extract, filter, sort, unique, cut, wrap, slugify, strip HTML, count), data (JSON format and JSONPath, YAML, CSV, flatten, SQL and XML formatting, Markdown tables), time, numbers, network (URL parse, query strings, defang, IP conversion, extraction) and password-based AES-GCM encryption.
Every operation is JavaScript in this page, with hashing and encryption done by the browser's Web Crypto API. The input you paste, the keys you type into an HMAC or AES step and the output never leave the tab. The privacy indicator in the header counts network requests the page makes; it stays at zero while you work.
Each preset loads a sample input and a recipe that solves a real, recurring problem. Run one, then edit a step or add your own.
Operations take text in and produce text out, so any step can follow any other. Arguments are small and explicit — a delimiter, a regex, a hash name, a password — and every argument is stored in the recipe.
| Group | Operation | What it does | Arguments |
|---|---|---|---|
| Encoding | Base64 encode | UTF-8 text to Base64 (standard or URL-safe alphabet). | URL-safe (no padding) |
Base64 decode | Base64 or base64url to text. Binary results are shown as a hex dump. | — | |
Hex encode | UTF-8 bytes as lowercase hexadecimal. | Separator | |
Hex decode | Hexadecimal (with or without separators, 0x) to text. | — | |
Base32 encode | RFC 4648 Base32. | — | |
Base32 decode | RFC 4648 Base32 to text. | — | |
URL encode | Percent-encode for a query component, or only characters a full URL cannot contain. | Mode | |
URL decode | Percent-decoding; + becomes a space in form mode. | + is a space | |
HTML escape | Escape &, <, >, " and ' as entities. | — | |
HTML unescape | Decode named, decimal and hex entities. | — | |
Unicode escape | Non-ASCII characters as \uXXXX (surrogate pairs for astral code points). | — | |
Unicode unescape | Turn \uXXXX, \u{X}, \xXX and \n style escapes back into characters. | — | |
Escape as JSON string | Wrap the text in a JSON string literal. | — | |
Unescape JSON string | Parse a JSON string literal (quotes optional) back to text. | — | |
Binary encode | Each byte as 8 bits. | — | |
Binary decode | Groups of 8 bits to text. | — | |
To char codes | Unicode code points of each character. | Base | |
From char codes | Decimal or U+hex code points to text. | — | |
ROT13 / ROT-N | Rotate letters by N (13 is its own inverse). | Rotate by | |
Gzip compress | Gzip the text and emit Base64 (what many APIs and log shippers carry). | Algorithm | |
Gzip decompress | Base64 (or hex) of gzip/deflate data back to text. | Algorithm | |
JWT decode | Header and payload of a JSON Web Token as JSON (no verification). | — | |
| Hashing | MD5 | MD5 digest (legacy checksums only). | Output |
SHA-1 | SHA-1 digest of the UTF-8 bytes. | Output | |
SHA-256 | SHA-256 digest of the UTF-8 bytes. | Output | |
SHA-384 | SHA-384 digest of the UTF-8 bytes. | Output | |
SHA-512 | SHA-512 digest of the UTF-8 bytes. | Output | |
HMAC | Keyed hash with a secret. | Hash, Key, Output | |
CRC32 | CRC-32 checksum (as used by zip and PNG). | — | |
Hash each line | One SHA-256 (or other) digest per line, tab-separated. | Hash | |
| Text | Change case | Upper, lower, title, sentence, camelCase, snake_case, kebab-case, CONSTANT. | To |
Trim | Remove leading/trailing whitespace from the whole text or each line. | Mode | |
Find & replace | Literal or regular-expression replace with $1 groups. | Find, Replace with, Regex, Flags | |
Extract matches | Every regex match (or a group) on its own line. | Regex, Group (0 = whole match), Unique only | |
Filter lines | Keep or drop lines matching a pattern. | Pattern, Mode, Regex, Ignore case | |
Sort lines | Alphabetical, natural (numbers in order), numeric, by length, or shuffle. | Order, Ignore case | |
Unique lines | Remove duplicate lines (optionally with counts). | Prefix counts, Ignore case | |
Remove empty lines | Drop blank (or whitespace-only) lines. | — | |
Number lines | Prefix each line with its number. | Start at, Separator | |
Head / tail | Keep the first or last N lines. | Keep, Lines | |
Reverse | Reverse characters, or the order of lines. | Mode | |
Split / join | Split on a delimiter into lines, or join lines with a delimiter. | Mode, Delimiter | |
Cut column | Pick one column from delimited lines (like cut -d -f). | Delimiter, Column (1-based, negative from end) | |
Wrap / truncate | Wrap long lines at a width, or cut each line to a length. | Mode, Width | |
Slugify | URL slug: lowercase ASCII with hyphens, diacritics stripped. | — | |
Strip diacritics | café → cafe, using Unicode decomposition. | — | |
Strip HTML tags | Remove tags and decode entities, keeping the text. | — | |
Count | Characters, words, lines, bytes and the most frequent words — as a report. | — | |
Pad lines | Pad each line to a width on the left or right. | Side, Width, Character | |
Prefix / suffix lines | Add text before and after every line (e.g. quotes and commas for SQL IN lists). | Prefix, Suffix | |
| Data | JSON format | Pretty-print (or minify / sort keys). | Indent, Sort keys |
JSON query (JSONPath) | Pick values out of a document: $.a.b, $[*].id, $..name, $[?(@.x > 1)]. | Path | |
JSON → YAML | Render JSON as block-style YAML. | — | |
YAML → JSON | Parse YAML (safe schema) to JSON. | Indent | |
CSV → JSON | Rows become objects keyed by the header (numbers and booleans typed). | Delimiter, Type numbers/booleans | |
JSON → CSV | An array of objects (nested keys flattened with dots) to CSV. | Delimiter | |
JSON flatten | Nested object to one level with dotted keys (or back). | Mode | |
SQL format | Format SQL for a dialect. | Dialect | |
XML format | Indent XML (or minify). | Mode | |
Markdown table | CSV or JSON array into a Markdown table. | — | |
| Time | Unix time → date | Seconds or milliseconds since the epoch to ISO 8601 (each number on its own line). | Zone |
Date → Unix time | Any date the browser can parse to epoch seconds. | Unit | |
Current time | Replace the input with the current time in several forms. | — | |
| Numbers | Number base | Convert integers between decimal, hex, binary, octal (one per line). | From, To |
Bytes → human | 1536 → 1.5 KiB, one per line. | Units | |
Sum / statistics | Sum, average, min, max, count of the numbers found. | — | |
| Network | URL parse | Scheme, host, port, path, query parameters and fragment as JSON. | — |
Query string ↔ JSON | a=1&b=2 to JSON and back. | Mode | |
Defang / refang URLs | hxxp://example[.]com style, so links in reports cannot be clicked, and back. | Mode | |
IP ↔ integer / hex | IPv4 dotted quad to integer or hex and back, one per line. | To | |
Extract URLs / IPs / emails | Pull every URL, IPv4 address or email out of free text. | Extract, Unique only | |
| Crypto | AES-GCM encrypt | Encrypt with a password (PBKDF2-SHA256, 310k iterations). Output is base64: salt·iv·ciphertext. | Password |
AES-GCM decrypt | Decrypt output of the encrypt step with the same password. | Password | |
Random | Replace the input with random bytes, a UUID, or a password. | Kind, Length / count |
Real payloads are layered. A webhook body is JSON inside Base64 inside a URL parameter; a log line contains a token that contains a JSON payload; a CSV export needs cleaning before it can be queried. Doing that with one-shot tools means copying intermediate results between pages, and the copying is where mistakes happen — a trailing newline, a lost character, the wrong field. A recipe removes the copying: the intermediate values are shown but never retyped.
The model is the one Unix pipes introduced fifty years ago, with the addition that every stage is visible. base64 -d | gunzip | jq .payload is a Flow recipe with three steps, except you can see what came out of gunzip before jq complained about it.
A step that fails — invalid Base64, a regex that does not compile, JSON that does not parse — reports the reason on its own card and the chain stops there; the steps after it are marked as skipped rather than run against garbage. Fix the argument or the input and the chain resumes. Operations that decode binary data show a hex dump when the result is not text, so a decode that "worked" but produced bytes is not mistaken for a decode that produced a string.
AES-GCM encrypt derives a 256-bit key from your password with PBKDF2-SHA256 at 310,000 iterations and a random salt, encrypts with a random nonce, and packs salt, nonce and ciphertext into one Base64 string. Decrypt reverses it and fails loudly on a wrong password or altered data, because GCM authenticates what it encrypts. It is a sound way to protect a note or a config snippet you are about to paste somewhere; it is not a replacement for a secrets manager, and the strength of the result is the strength of the password you chose.
A recipe is the ordered list of steps with their arguments, stored as a small JSON document you can copy from the Recipe pane and paste back with the import button. The Share link button in the header goes further: it compresses the recipe and the current input into the URL fragment, which browsers never send to a server, so opening the link reproduces the whole session on the other person's machine without anything having been uploaded.
By structure, not by guessing at meaning: three base64url segments beginning with eyJ are a JWT; Base64 beginning with H4sI is gzip; percent signs followed by hex digits mean URL encoding; ampersand-named entities mean HTML; a 10-digit number near the present is a Unix timestamp; consistent comma or tab counts across lines mean CSV; valid JSON is offered formatting and a JSONPath query. Each suggestion is scored and the best few are shown. It only suggests; nothing runs until you click.
Steps pass text between them. Decoders that produce bytes which are not valid text show them as hexadecimal, and the hex decode and Base64 decode steps accept that back, so binary can be carried through a chain in hex form. Files opened with the upload button are read as UTF-8 text; for hashing large binary files use the hash generator, which streams the file through Web Crypto.
The same engine as the JSON tool: $.a.b, bracket keys, numeric and negative indexes, [*] wildcards, .. recursive descent, slices such as [0:5], unions, .length, and filters such as [?(@.qty > 5 && @.status == 'paid')] with comparison, regex matching and boolean operators. One match is output as its value, several as a JSON array.
No. The operations are JavaScript functions in this page, hashing and encryption use the browser's Web Crypto API, and compression uses the browser's built-in CompressionStream. The header indicator counts network requests made by the page's own code and stays at zero. The optional history is stored in your browser's own database and can be cleared from the command palette.
CyberChef is a large, security-analysis-oriented toolkit with hundreds of operations and a correspondingly dense interface. Flow covers the operations developers reach for daily — encodings, hashes, JSON, CSV, YAML, text cleanup, URLs, timestamps — with per-step previews, magic suggestions, presets for common jobs, and recipes that share as links. If you need cipher cryptanalysis or forensic file carving, CyberChef is the right tool; if you need to get a JSON payload out of a Base64 blob and pick one field, this page is faster.
Most text operations are line-aware: hash each line, filter lines, sort, unique, cut column, number conversion, timestamp conversion and IP conversion all work on every line of the input independently. Paste a list, build the recipe once, and every line is processed. For per-file batch work on a pattern, the regex tester's batch mode is the complement.