Encoded Payload Decoder

Paste a suspicious encoded string — a PowerShell command, a URL parameter, a script fragment — and see it decoded layer by layer, with what each layer revealed. The property it gets right that naive decoders do not: a successful decode is not the same as a real one. Base64 accepts any input of the right alphabet, and the decisive check is the proportion of invalid-UTF-8 replacement characters, because that character is ITSELF printable — a decode of pure noise otherwise scores as clean text on every other measure while being nothing but a wall of them. A layer that only marginally qualifies is reported as uncertain rather than chained onward, because inventing a decoding that never happened puts fabricated plaintext in front of an analyst. Nothing is executed, fetched, decompressed or evaluated; binary layers are identified by magic bytes and left alone.