WebSocket Frame Parser
Decode a raw WebSocket frame from hex and explain its opcode, length and payload.
WebSocket Frame Parser
Paste the bytes of a single RFC 6455 frame as hex. The page reads the FIN and opcode bits, the length field, the masking key and the payload, unmasks it and shows the decoded text when the frame is a text frame. Everything runs in the browser.
Frame
Payload
History tool ini
Data terakhir yang pernah kamu isi di tool ini, tersimpan hanya di device/browser ini.
Save what you type here, in this browser? Your work would go into this browser's local storage, so a refresh or a trip to another tool does not wipe it. You also get a short list of previous entries under the form, each one restorable with a click. Nothing is ever uploaded, and there is no account.
Being straight about the trade-off: anything kept there can be read by anyone who can use this browser profile, and by any script that later runs on this site. A tool page can hold a private key, a password or a signed token. Saving is convenient; it is not private.
About this tool
Paste the hex bytes of a single WebSocket frame and the page decodes the bits the RFC defines: FIN, the reserved bits, the opcode, whether the frame is masked, the payload length, the masking key and the payload itself. Text frames are unmasked and shown as readable text.
Questions
- Where do I get the raw frame bytes?
- From a packet capture or a proxy that logs frames, such as Wireshark with a WebSocket filter, or from a test that dumps the bytes your client sent. Copy the frame payload bytes, not the TCP or TLS wrapper, and paste them as hex.
- Why is the payload scrambled?
- Client-to-server frames are masked, so the bytes on the wire are XORed with a four-byte key. The parser applies that key to recover the payload. A server-to-client frame is not masked and is shown as it arrived.
- What does the opcode mean?
- 0x1 is text, 0x2 is binary, 0x0 continues a fragmented message, 0x8 closes the connection, 0x9 is a ping and 0xa is a pong. Anything else is reserved and is labelled as such rather than guessed at.
- Does this connect to a server?
- No. It reads bytes you paste and nothing else. There is no socket and no request, so it is safe for frames that contain tokens or message payloads from production.