Paste a Windows event, get it decoded
Got an event open in Event Viewer right now? Right-click → Copy → Copy Details as XML, paste it here, and see what every field in your event means — logon types, status codes, and ticket encryption translated, with the reference explanation next to your actual values. No file to export, no account, and the event never leaves your browser.
Paste the event XML
In Event Viewer: right-click the event → Copy → Copy Details as XML, then paste it below. Parsing happens entirely in your browser — the event itself is never uploaded or stored, and it is excluded from session recording. We log only the numeric Event ID.
No account. Your event data never leaves your browser.
Frequently Asked Questions
- Does my event data get uploaded anywhere?
- No. The XML is parsed in your browser with the built-in DOMParser — there is no API call carrying your event, nothing is written to storage, and the pasted content is never logged. You can verify it: open devtools, switch to the Network tab, and decode an event. You will see no request containing your event data. You will see two small requests to our analytics provider (PostHog) — those carry the numeric Event ID and the fact that a paste happened, never the field values. The paste box and its results are also excluded from session recording, so account names, IP addresses, and hostnames from your event are never captured.
- How do I copy an event as XML from Event Viewer?
- Open Event Viewer, select the event in the list, then right-click it and choose Copy → Copy Details as XML. That puts the complete <Event> element on your clipboard, including the System block and every EventData field. Nothing is written to disk and you don't need to export or save the log.
- What if the Event ID isn't in your reference?
- You still get the decoded output — the System metadata, every EventData field with its value, and any values we can translate (logon types, status codes, ticket encryption types). You'll also get the closest Event IDs we do document. It's never a dead end.
- Why not just paste the event into ChatGPT?
- You can, and for a single event it works. The difference is that this decode is deterministic — the field descriptions come from a maintained reference, not from a model that may confabulate a field name. The larger difference is scope: a single event is reference material, but attacks are sequences. Determining that a 4624 belongs to the same story as a 4728 four minutes later and a 7045 after that is correlation, which is what the analyzer does.