What's new

Every entry in the tag menu and every tag search result can now be dragged as well as clicked, and so can the &&, ||, + Text and newline buttons. In Tags mode, drop a tag on the input and it opens at the pointer with the cursor between the tags, or drop it onto a selection to wrap that text. In Jigsaw mode, drop anything on the canvas to add the piece where the pointer is; dropped next to a piece, it fits straight on. The ghost under the pointer shows what you are about to drop: the markup, or the piece.

The Autodecoder panel under the converter is gone. Select some text in the input instead and, when the autodecoder recognises an encoding in it, the tooltip that already offers the Looks like decodes gains an Autodecode button. Press it and the selection becomes the recipe the autodecoder worked out, nested encode tags around the plaintext, so the output stays what you selected. Hover the button to preview the recipe first.

<@encode(url)><@encode(base64)>secret</@encode></@encode>

It works on part of the input as well as all of it, so an encoded value in the middle of a request can be unpicked where it sits.

A new Encrypt pair does real symmetric and asymmetric crypto, right in the sandbox. aes encrypts and decrypts in CBC, GCM, CTR or ECB with a UTF-8, hex or base64 key, and an auto-generated IV is prepended to the output so it round-trips.

<@encode(aes,'GCM','secretsecretsecr','utf8')>top secret</@encode>

rsa encrypts with a PEM public key and decrypts with a private key, using OAEP (SHA-256) or PKCS#1 v1.5. A new Generate category adds uuid, randomBytes and randomString for quick test data. JWT gains jwtNone, which builds an alg:none token to probe signature-bypass flaws. Conversions add jsonEscape, jsonToYaml and yamlToJson, and the string tools gain sortLines, dedupeLines and count.

Thirty-three built-in tags landed at once, with three new categories. JWT adds jwtDecode, jwtSign and a jwtVerify check that works as a condition operand. Cipher brings the classics: caesar, vigenere, atbash, affine and railFence, all of which encode and decode. Datetime has timestampToDate, dateToTimestamp and now.

Hashing gains ntlm, crc32, hmac and sha3 (with a Keccak option). Conversions gain quotedPrintable, morse, base45, csvToJson, queryStringToJson and jsonToXml. There are new string helpers (regexEscape, trim, substring, swapCase), IP tools (ipv6Expand, ipv6Compress, cidrExpand) and more condition checks (matchesRegex, startsWith, endsWith, isEmpty, isBase64).

The hacking room has been rebuilt. Sign in and you get a personal room: open it in every browser you have, press Execute in one of them, and the Runs panel shows what each browser made of the payload. Create a private room to work with other people: invite them by username, they get a notification under the new bell in the navbar, and they are in once they accept.

Every run now carries the JS, the HTML and all of the HackPad options, and each browser runs it in a sandboxed frame of its own, so several people can send payloads at once and every result lands on the run that produced it. Start at Hacking rooms.

Tag code now runs in a web worker inside the sandboxed iframe. A worker has no document, no forms and nothing to navigate, so a tag from the store has no way to send your input anywhere, and a tag that never returns no longer freezes the page: the conversion is stopped after 15 seconds and says so.

Writing your own tags? There is no document, window or DOMParser in a worker. Use hv.decodeHtmlEntities(input), hv.parseXml(input, mimeType) and hv.prompt(userPrompt, systemPrompt) instead; each returns a promise. The details are in the help.

What you save from the converter is now called a recipe: the tags and text that produce an output, which is worked out again whenever the recipe is opened. What you save from HackPad is a pad. Browse them at Recipes and Pads, or find your own under My recipes and My pads in the avatar menu.

Nothing you shared has broken: every old /urls link redirects to its new address, and private links that keep their data in the URL hash work exactly as before.

Select text in the input and Hackvertor tells you what it looks like. A tooltip under the selection offers the decodes that fit: a tag whose matches() method takes the whole selection, or one whose startsWith() method recognises part of it. Choose decode to swap that text for what it decodes to, or decode → encode to swap it for the decoded text inside the matching encode tag. The result stays selected, so a nested encoding comes apart one click at a time.

Every installed tag that defines those methods takes part, so the suggestions get better as you install more tags. Read more in The editors.

Building the same chain twice is now a shortcut away. Select a piece and press Duplicate or Ctrl/⌘+D to copy it into a new row, or hold Alt while dragging a piece to drag a copy of it and everything after it, leaving the original in place.

• Shift-click pieces, or drag a box across empty canvas, to select several at once; Ctrl/⌘+A selects everything.
• A selection duplicates as one row per run of adjoining pieces, and the copies come out selected so they can be dragged straight into place.
• Delete removes the whole selection in one go.

Read more in Jigsaw mode.

Jigsaw mode now tells you what every piece does. After a conversion each tag piece shows the value it produced, so you can follow a payload through the chain instead of only seeing what comes out of the end.

• A tag that fails is outlined in red with its error, and each operand of a condition gets a green or red dot. Operands that were skipped are dimmed.
• Solve runs the autodecoder on a text piece and replaces it with the chain of tags that produces it.
• Flip row turns an encoder into its decoder, and back again.
• When a piece's value looks encoded, the panel suggests the decode that fits.
• Wires join each setVariable to the getVariable pieces that read it, and Branch sends one value into several rows. Load one of the variable examples from the Examples menu to see the wires — including a request-smuggling payload whose chunked size line is computed from the smuggled request.

Read more in Jigsaw mode.

Tags can now make decisions. A tag that implements a check() method returns true or false, and you can combine checks with &&, || and ! to choose what gets output. Encode only when the input is JSON, fall back when a decode fails, or pick between two fixed values:

<@check(isJson)>{"a":1}</@check> && <@encode(base64)>{"a":1}</@encode>

<@check(isNumeric)>13a37</@check> && number || not a number

!<@check(isNumeric)>abc</@check> && <@encode(base64)>abc</@encode>

• Plain text works as an operand, so a condition can output a fixed value either way.
• A tag that throws counts as false, so || moves on to your fallback.
• Conditions can sit inside other tags, and && binds tighter than ||.
• The built-in check tags (isJson, isNumeric, equals and contains) are in the Checks category of the tag menu.
• The new Examples menu above the input loads worked conditions in one click, in either Tags or Jigsaw mode.

Read more in Conditions with && and ||.

Build conversions visually. Switch the input to Jigsaw and every tag becomes a puzzle piece: start with a text piece, then snap tags on to the right, each one wrapping the piece before it. The chain is turned into ordinary Hackvertor tags for you, so you can flip back to Tags mode at any time.

• && and || operator pieces let you build whole conditions out of check tags without typing any syntax.
• Text pieces can join an expression as operands, so a row can end in a fixed value.
• Expand the canvas to full width when a chain outgrows the editor, and contract it again when you are done.
• The text dialog floats over the canvas, so editing a piece never shifts your layout.

The sandbox is now frozen before any tag runs, so one tag can never interfere with another. Built-ins such as btoa, hv and every tag instance are read-only, and assigning to them throws a TypeError. Installing a tag from the store cannot change how your other tags behave.

Writing your own tags? Keep per-call state in local variables rather than on this.

A variable can now be read before it is set. If getVariable appears earlier in the input than the setVariable that fills it, the read simply waits for the write later in the same conversion. Tag authors get the same behaviour from hv.awaitVariable(name).

• A machine-readable API reference documents everything available to tag code, and the sample code points to it.
• A Remove comments button strips every comment from your tag code in one click.
• Declared arguments are now shown in the tag's source code, so you can see exactly what a tag accepts.
• Hovering a tag in the editor highlights the option that is actually selected, and the tag store search has been fixed.

Ready to build one? Create a new tag or read Creating your own tags.