Recognising encodings
Tell Base64 from hex from Base32 from binary on sight, peel layered encodings, and learn why an encoding is not encryption.
By the end you can
- Identify Base64, Base64-URL, hex, Base32, binary, and Morse from their alphabets alone
- Decode a multi-layer wrapper without guessing the order
- Explain why encoding provides no confidentiality
- Recognise when a decode produced bytes rather than text, and switch approach
1. Read
Spot the encoding: reading base64, base32, hex and friends at a glance
Alphabet, length, and padding are enough to name almost any encoding on sight. A field guide to the encodings CTFs actually use, the magic prefixes that tell you what is underneath, and the traps that make a correct guess look wrong.
The first ten minutes: a triage playbook for any CTF challenge
Most challenges are lost to flailing, not to difficulty. Here is a repeatable order of operations for an unknown blob, an unknown file, and an unknown service - and the point at which you should stop guessing and start reading.
2. Use the tools
In the order they come up while solving. Each opens the workspace tab that runs it.
Cipher identifier and automatic decoder
Paste anything and find out what it is. ctfpal runs every decoder and rotation, including multi-pass cascades, and ranks results by English-likeness and flag patterns.
Base64 decoder and encoder
Decode and encode Base64 and Base64-URL in the browser, with padding repair and automatic detection of nested encodings. Nothing is uploaded.
Hex to text converter
Convert hexadecimal to text and back, tolerating whitespace, commas, and `0x` prefixes. Runs entirely in your browser.
Base32 decoder and encoder
Decode Base32 (RFC 4648) to text or bytes, with padding repair. Distinguishes Base32 from Base64 and hex automatically.
Binary to text converter
Convert binary (and decimal codepoints) to text and back. Handles 7-bit and 8-bit groupings, arbitrary separators, and reversed bit order.
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
Practice
generated here, checked here, no account and nothing to download
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 52 match in total - see the full index.
Checkpoint
Given a three-layer encoded string, produce the plaintext and state each layer in order.
Teaching note
The instinct students arrive with is to try decoders at random until one works. The habit worth building instead is to look at the alphabet first and predict the format before decoding - being right is the point, not the answer.