Inspect traffic
Quick Preview
Decode selected text in Cloak Proxy with a right-click. Quick Preview reads JWTs, Base64, URL-encoded strings, Unix timestamps and JSON in a small panel.
APIs are full of values that mean nothing until you decode them: a token in a header, a Base64 blob in a JSON field, a cursor in a query string, a timestamp in seconds. Quick Preview decodes the text you select and shows the result in a small panel, without copying it into another tool.
Decode selected text
Section titled “Decode selected text”-
Open a text view in the inspector, for example the Raw tab, a body in Pretty or Raw, or the headers in Text mode.
-
Select the value you want to decode.
-
Right-click the selection.
The menu starts with one Decode as item for each way the text can be read, such as Decode as JWT or Decode as Timestamp. If the text can’t be decoded, you get the normal menu.
-
Choose one.
A panel titled Quick Preview: JWT (or Base64, Timestamp and so on) opens with the result.
The panel’s text is selectable, so you can copy any part of it. Resize the panel to fit long results, and close it when you’re done. You can keep up to eight panels open; opening a ninth closes the oldest.
Switch headers to Text, then select a token to decode it.
- Text mode makes headers selectable for Quick Preview
Decoders
Section titled “Decoders”| Menu item | Appears when the selection | Shows |
|---|---|---|
| Decode as JWT | Is a JSON Web Token: three dot-separated parts whose first two decode to JSON | The token’s Header and Payload as formatted JSON, then Issued, Not before and Expires dates from iat, nbf and exp, with (expired) or (valid) after the expiry, and the note Signature is not verified. |
| Decode as Formatted JSON | Is valid JSON | The JSON, indented |
| Decode as Base64 | Is Base64 or Base64URL (at least 4 characters) that decodes to readable text | The decoded text. If that text is JSON, it’s indented. |
| Decode as URL-decoded | Contains % escapes |
The text with percent-encoding decoded, for example %20 as a space |
| Decode as Timestamp | Is a number that reads as a date between 2000 and 2100, in seconds or milliseconds since 1970 | The full date and time in your time zone, and the same moment in ISO 8601 |
Spaces and line breaks around the selection are ignored. One selection can match several decoders. 1700000000, for example, is both valid JSON and a timestamp, so the menu offers both and you pick the one you want.
Examples
Section titled “Examples”| Select | Choose | Result |
|---|---|---|
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.sig |
Decode as JWT | Header {"alg": "HS256"}, payload {"sub": "123"} |
eyJ1c2VyIjoiYWRhIn0= |
Decode as Base64 | { "user": "ada" }, indented |
ada%40example.com |
Decode as URL-decoded | ada@example.com |
1700000000 |
Decode as Timestamp | The date in your time zone, and 2023-11-14T22:13:20Z |
1700000000000 |
Decode as Timestamp | The same moment, read as milliseconds |
Where it works
Section titled “Where it works”Quick Preview works in any read-only text view that shows monospaced text:
| Where | How to get there |
|---|---|
| Request and response bodies | Body tab, in Pretty, Raw or Hex |
| Headers | Header tab, switched to Text |
| Whole messages | Raw tab in either pane |
| Tokens | Auth tab |
| Generated code | Code tab |
| GraphQL queries | GraphQL tab, the Query part |
| WebSocket frames | Messages tab, the selected frame in Raw |
It doesn’t work in tables (the Header tab in Table mode, Query, Cookies, Form) or in the JSON Tree. To decode a value from those, switch to a text mode, or right-click the row, choose Copy Value, and check it elsewhere. In the JSON tree, Copy Value gives you the string without quotes.