Where your data goes

	Using this page	Using the API, MCP or A2A
Where it runs	In your browser. Text is converted to UTF-8 bytes with `TextEncoder` and formatted with plain JavaScript.	In a Cloudflare Pages Function at the Cloudflare data centre nearest the caller.
What leaves your device	Nothing you enter. After the page and its scripts load, no request carries your input. The browser enforces this: the page's Content-Security-Policy sets `connect-src 'none'` and `form-action 'none'`, which block fetch, XHR, WebSocket, EventSource, beacons and form posts.	The server receives the `input` text and `mode`, converts it in memory inside the request, and returns the result. Your input is not stored or logged; only the per-call metadata row (operation, time, status, sizes) is recorded. Send secrets in a POST body, not the query string: URLs are recorded in Cloudflare request logs, proxies, and shell history.
Stored	Nothing leaves the page. No cookies, analytics or third-party scripts; the browser keeps only your View → Inline config choice.	Your inputs and results: never. What is stored is your client record (client ID, a SHA-256 hash of your secret, expiry, and the profile you registered with) and one metadata row per call: operation, time, transport, status, error code, duration, request and response sizes, and country.
Logged	Nothing (no requests are made).	Only the per-call metadata above, attributed to your client ID. Never parameters, bodies, results, or credentials. Cloudflare, as the host, also processes request metadata (IP address, full URL including the query string, headers) under its own policies, so put inputs in POST bodies.
Access	Open to anyone.	Requires a client ID and secret (how to get one). HTTPS only; TLS terminates at Cloudflare.

Details and how to verify this yourself: Security & privacy.

User guide

The tool sits in a window that works like a desktop app: menus on the top row and the full-screen icon at its right (Esc leaves full screen). The set-up options described below are in Settings → Options…, an overlay, and the Settings menu also lists the common choices directly. To keep the options in view instead, choose View → Inline config; the page remembers that choice. Help → Keyboard shortcuts… lists the keys.

Text → Hex shows the UTF-8 bytes of your text. Choose a layout:
- Plain: 486920e282ac
- Spaced: 48 69 20 e2 82 ac
- \x: \x48\x69…, for C, Python and shell strings
- 0x: 0x48, 0x69, …, for array literals
Hex → Text accepts any of those layouts, mixed, in upper or lower case. Colons are allowed too (48:69).

This is a quick way to see why a “simple” string is longer than expected: € is three bytes (e2 82 ac) in UTF-8.

Specification

Encoding. Each UTF-8 byte of the input becomes two lowercase hex digits.

Mode	Separator and prefix
`plain`	none
`spaced`	one space between bytes
`escaped`	`\x` before each byte, no separator
`prefixed`	`0x` before each byte, `,` between bytes

Decoding.
1. Remove every 0x and \x prefix (case-insensitive), plus whitespace, commas and colons.
2. What remains must be an even number of hex digits.
3. The resulting bytes must be valid UTF-8; decoding uses fatal mode, so nothing is silently replaced.
Errors. Odd digit count, a non-hex character, or invalid UTF-8 (meaning binary data, which this tool does not display).

API & MCP

The same logic is available over HTTP and as MCP tools. Unlike this page, these run on the server: see where your data goes.

GET POST /api/hex/encode Text to hexadecimal UTF-8 bytes. MCP tool hex_encode · 2 parameters · full reference → GET POST /api/hex/decode Hexadecimal bytes to text. MCP tool hex_decode · 2 parameters · full reference →