# WebSocket Frame Decoder

Decode raw WebSocket frames (hex or base64) byte by byte per RFC 6455: FIN/RSV/opcode, MASK bit, extended lengths, masking key, unmasked payload, close codes, and protocol-violation warnings.

> Canonical page: https://elysiatools.com/en/tools/websocket-frame-decoder

- **Category:** Development

- **Keywords:** websocket, rfc6455, frame decoder, opcode, masking key, hex dump, close code

## Overview

Frame layout per RFC 6455 §5.2: byte 0 = FIN + RSV1-3 + opcode; byte 1 = MASK + 7-bit length (126 → uint16 BE, 127 → uint64 BE); 4-byte masking key when MASK=1; payload unmasked by XOR with key[i mod 4]. Control frames (opcode ≥ 8) must have FIN=1 and payload ≤ 125 bytes; client→server frames must be masked.

## Inputs

- **WebSocket frame data (hex or base64)** (textarea): 81 85 37 fa 21 3d 7f 9f 4d 51 58 (hex dump or base64, multiple frames allowed)
- **Input encoding** (select)
- **Max payload bytes to show** (number)

## When to use

- When you have a hex dump or Base64 capture of WebSocket traffic and need to inspect individual frames.
- When debugging masking, opcodes, extended lengths or close handshakes against RFC 6455 rules.
- When verifying control-frame constraints (FIN=1, payload ≤ 125 bytes) or client-to-server masking requirements.

## How it works

- Paste one or more raw frames (hex with optional spaces, or Base64) into the frames field.
- Select auto-detect, hex or Base64 encoding; leave max payload bytes at the default 256 or set a limit between 16 and 4096.
- The decoder walks each frame: byte 0 for FIN/RSV/opcode, byte 1 for MASK and length, optional extended length and 4-byte masking key, then XOR-unmasks the payload.
- It renders a structured HTML view of every field, unmasked text or hex payload, close-code semantics and warnings for violations such as fragmented control frames.

## Use cases

- Inspect hex dumps exported from browser developer tools or packet captures of live WebSocket sessions.
- Validate a custom WebSocket client or server implementation against RFC 6455 frame layout and masking rules.
- Examine ping, pong and close frames in logs to diagnose connection teardown or keep-alive problems.

## Frequently asked questions

### What input encodings does the decoder accept?

Hex dumps (spaces optional) or Base64. Auto-detect chooses the format automatically.

### Can I paste several frames at once?

Yes. Consecutive frames in a single hex or Base64 dump are decoded independently.

### How are close frames interpreted?

The first two payload bytes are shown as the status code (for example 1000) together with any remaining UTF-8 reason string.

### Does the tool flag protocol violations?

Yes. It warns when control frames lack FIN=1, exceed 125-byte payloads, or when client-to-server frames are unmasked.

### How much of a large payload is displayed?

The unmasked payload is truncated to the max-payload-bytes setting (default 256, range 16–4096) and shown as text or hex.

## Related tools

- [Base64 Encoder/Decoder](https://elysiatools.com/en/tools/base64-encoder): Encode and decode Base64 strings
- [Base64URL Encoder/Decoder](https://elysiatools.com/en/tools/base64url-encoder): Encode and decode Base64URL (URL-safe Base64 variant used by JWT/JWS/JWE), with conversions between standard and URL-safe Base64
- [WebAuthn Passkey Assertion Decoder & Challenge Debugger](https://elysiatools.com/en/tools/webauthn-passkey-assertion-decoder-challenge-debugger): Decode WebAuthn/FIDO2 assertion fields, inspect authenticatorData flags and signCount, check challenge/origin/rpIdHash binding, and optionally verify ES256, RS256, or Ed25519 signatures with a supplied COSE public key.
- [Distributed Trace Decoder & Waterfall Visualizer](https://elysiatools.com/en/tools/distributed-trace-decoder-waterfall-visualizer): Decode Jaeger, Zipkin, or OpenTelemetry trace JSON and render span timing, dependencies, and error hotspots as an interactive waterfall report
- [NTP RFC 5905 / SNTP Leap Second & Epoch Decoder](https://elysiatools.com/en/tools/ntp-rfc-5905-sntp-leap-second-epoch-decoder): Decode an NTP/SNTP 48-byte packet: LI/VN/Mode bitfield, stratum, poll, precision, root delay/dispersion, reference ID (with clock & kiss codes), and four 64-bit 1900-epoch timestamps
- [Snowflake / Discord ID Bit Decoder](https://elysiatools.com/en/tools/snowflake-discord-id-bit-decoder): Decode 64-bit Snowflake-style IDs for Discord, Twitter, Mastodon, Sonyflake, Instagram, or a custom bit profile. Extract timestamp, worker/process/machine, sequence fields, align platform epochs, and infer a Discord shard when a shard count is supplied.
- [ULID / NanoID / KSUID / Snowflake ID Decoder](https://elysiatools.com/en/tools/ulid-nanoid-ksuid-snowflake-id-decoder): Decode lexically sortable IDs losslessly with BigInt: ULID (Crockford base32), KSUID (base62), NanoID, MongoDB ObjectId, and Discord/Twitter/Sonyflake Snowflakes — with ISO timestamps, raw hex, bit-level field breakdowns and birthday-bound collision probabilities.
- [Base64 Converter](https://elysiatools.com/en/tools/base64-converter): Encode and decode data to/from Base64 format with URL-safe options

## Samples

- [WebSocket Samples](https://elysiatools.com/en/samples/websocket): Real-time communication examples using WebSocket protocol including chat, notifications, and live data streaming
- [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion
- [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion
- [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion

## Related content

- [Semi-Structured Text Parsing and Table Extraction Tools](https://elysiatools.com/en/hubs/semi-structured-text-table-extraction): Turn fixed-width text, mixed-delimiter records, logs, and HTML or Markdown tables into clean CSV, JSON, XML, or Excel outputs with focused parsing and repair tools.