Direction
Input
Output
Off by default. Uses localStorage only — never a cookie, never a server.
Fully client-side. Every cipher in the dropdown is a plain JavaScript
function running in this tab (
kaidoku-codecs-*.js, kaidoku-magic.js,
kaidoku-triage.js — short and readable on purpose). There is no API
endpoint. The site's Content Security Policy (connect-src 'self') makes it
technically impossible to send your text to a third party. Open your browser's
Network tab and use the tool: no request carries your input.
What Kaidoku will not do
- Break modern cryptography. AES, RSA and friends are out of scope. Hashes are identified, never “decrypted” — a hash is one-way, and any tool claiming otherwise is either looking it up in a leaked table or lying.
- Resolve what3words. Their wordlist is proprietary and only their API
can convert an address. Kaidoku recognises the
word.word.wordpattern and gives you a link you choose to click. No API key ships here, and no silent call is made. - Open anything for you. Detected links are defanged, inert text.
.onionaddresses get no one-click open at all. Card numbers, IBANs and wallet addresses are masked until you deliberately reveal them. - Pretend its glyphs are museum-accurate. Pigpen and Rosicrucian follow the standard grid construction. Templar, dancing men and the Standard Galactic Alphabet are CyberRamen drawings — reversible and printable, but not traced from the original plates, and the symbol pad says so. Zodiac Z408 is deliberately not shipped rather than shipped with a table we cannot verify offline.
How to use it
- Paste the ciphertext. Leave the cipher on Auto-detect if you don't know what you're looking at — it tries base64, hex, binary, Morse, ROT-n, Atbash, rail fence and more, chains up to three of them, and ranks the results by how much the output reads like English or French.
- Pick a cipher from the dropdown when you do know. The settings row changes to show only the fields that cipher needs, already filled with working defaults.
- Use Swap ⇆ to push the output back into the input — that's how you peel a base64 → ROT13 → rail-fence onion by hand.
- Read the content triage panel underneath. That's where a CTF flag, a Telegram invite or a pair of coordinates hiding in the plaintext shows up.
Related tools
- IOC Defanger — defang and refang indicators for safe sharing
- Character Encoder — deeper work on a single encoding
- Hash Toolkit — generate, verify and identify hashes
- JWT Decoder — full token inspection with claim explanations
- Link Extractor — pull every URL out of a blob of text
- IOC Pivoting — take the indicators further