Convert text to Leet Speak
Replace letters with numbers and symbols (a→4, e→3, t→7, ...) at three intensities, or decode 1337 back to plain text. All processing runs locally.
h3110 w0r1d
How to use Leet Speak
Pick an intensity, then letters are swapped for visually similar numbers or symbols. Heavy mode produces classic 1337 with multi-character substitutions.
- 01
Choose a mode
Encode swaps letters for leet substitutes; decode tries to recover the original text.
Bytes flow through
TextEncoder/TextDecoderfor predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.modeUTF-8TextEncoderlosslesslivemode · raw bytesencode · UTF-8encode | decode
loaded · UTF-8MIME · ready - 02
Pick intensity
Light = 6 common swaps. Medium = 10 swaps. Heavy = full multi-character 1337 alphabet.
Hash and signature operations call
crypto.subtlefrom the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.intensityWeb Cryptosubtledeterministicliveintensity · optionsmedium · livea→4 · e→3 · t→7 · ...
options applied · livelive - 03
Type or paste text
Letters are normalised to lowercase before being mapped. Other characters pass through.
Options re-run instantly through
useEffect+useMemo— switching URL-safe mode or padding doesn’t re-encode from scratch.inputmemoisedoptionsinstantreactiveinput · encodedtext · readyhello world
encoded · livelossless - 04
Copy or download
One click to clipboard. Download as .txt.
Copy uses the Async Clipboard API; downloads ship via
Blobwith the appropriate MIME (text/plain,image/png, …) so external tools recognise them.exportclipboardblobMIME-correctclient-sideout · copiedleet · doneh3ll0 w0rld
shipped · ready to shipsuccess
Encoding without surprises
Always UTF-8 first
Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.
URL-safe vs standard Base64
Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.
Hashes aren’t passwords
SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.
Watch padding rules
Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.
Use Web Crypto for keys
Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.
JWT decode ≠ verify
Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.
When to use Leet Speak
Gamer handles, retro chat, light obfuscation.
Gamer tags
Generate retro-style nicknames and clan handles. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.
RFC-compliantForum signatures
Stylise quotes the way the early internet liked it. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.
OpenSSL-matchedCreative writing
Voice 90s/2000s hacker characters convincingly. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.
losslessCTF flavour
Some CTF challenges leak hints in leet — practice decoding. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.
byte-identicalNaive censor bypass
See how naive keyword filters fall to leet substitutions. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.
spec-gradeLocalisation tests
Stress-test rendering with mixed letters and symbols. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.
production-readyFrequently asked questions
Something missing?
Tell us what you need. We ship the top requests every two weeks.