Paste the bytes of one 802.11 frame, from Wireshark or any hex dump, and see every field decoded: the header, fixed fields, elements, security handshakes and action frames, each with its IEEE 802.11 clause and a link to the Wi-Fi Glossary.
How it works
Every 802.11 frame starts with a MAC header (Frame Control, Duration, two to four addresses and a sequence number), carries a body, and ends with a 4-byte FCS checksum. Management frames such as beacons carry a few fixed fields followed by elements: small type-length-value blocks that advertise the network's name, rates, security and capabilities. Paste a frame below, or load a sample, then click any field to see its bytes, or any byte to see which field it belongs to.
1 · Paste a frame
Accepts a hex stream (80000000ffff…), bytes with spaces, colons or 0x prefixes, or a hex dump with offsets such as Wireshark's Copy › …as Hex Dump. A radiotap header in front of the frame and an FCS at the end are found automatically.
Radiotap header
FCS at the end
Decoding happens entirely in your browser. Nothing you paste is sent anywhere or saved.
2 · Decoded fields hover over a field for an explanation; click it to highlight its bytes
3 · Bytes
Notes
Getting 802.11 frames: a normal capture on a laptop shows Ethernet-style frames, because the Wi-Fi driver removes the 802.11 header. To see real 802.11 frames, capture in monitor mode (for example with Wireless Diagnostics › Sniffer on a Mac, or iw on Linux with a supported adapter). In Wireshark, select a frame, right-click the bytes pane and choose Copy › …as Hex Dump or …as a Hex Stream.
Explanations: hover over any field, or any byte, to see what it is and what it is for. On a phone or tablet, tap it: the explanation appears under the bytes.
Radiotap: monitor-mode captures usually start with a radiotap header added by the capture driver (not sent over the air) that records the channel, signal strength and data rate. The decoder reads the common fields and skips the rest using the header's own length.
FCS: the last 4 bytes of a frame are a CRC-32 over everything before them. When it's there, the decoder recalculates it: a mismatch means the frame was received with errors (or bytes were changed when copying).
Encrypted frames: the decoder shows the CCMP/GCMP header and packet number, but it can't decrypt the body. Management frames protected with PMF are shown the same way.
Sources: field layouts, names and code values follow IEEE 802.11-2024 (clause 9) and IEEE 802.11be-2024 for Wi-Fi 7 elements; each field shows its clause. Vendor-specific elements (WMM, WPA, WPS, Wi-Fi Alliance) follow their owners' specifications, and radiotap follows radiotap.org. One frame at a time; unusual or newer fields are shown as raw bytes.
↗ opens a term's full entry in the Wi-Fi Glossary, which explains over 400 Wi-Fi terms with their IEEE 802.11 references.