Lesson pack 1 · Foundation · 60 minutes
Recognising encodings
Tell Base64 from hex from Base32 from binary on sight, peel layered encodings, and learn why an encoding is not encryption.
Print this page for a paper plan - the navigation and links drop out.Student-facing version
Before the session
- Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
- Read the lesson yourself first - about 13 minutes.
- Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.
Objectives
Written as things a student can do afterwards, so they can be assessed rather than asserted.
- Identify Base64, Base64-URL, hex, Base32, binary, and Morse from their alphabets alone
- Decode a multi-layer wrapper without guessing the order
- Explain why encoding provides no confidentiality
- Recognise when a decode produced bytes rather than text, and switch approach
Running order (60 min)
| Time | What happens |
|---|---|
| 0:00-0:06 | Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails. |
| 0:06-0:18 | Teach the methodThe technique itself, on the board or from the lesson. No tools open yet. |
| 0:18-0:33 | Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice. |
| 0:33-0:54 | Practice setStudents work the challenges. Circulate rather than present. |
| 0:54-1:00 | Checkpoint and wrapCollect the artefact, name what comes next. |
Tools used
- Cipher identifier and automatic decoder - Paste anything and find out what it is. ctfpal runs every decoder and rotation, including multi-pass cascades, and ranks results by English-likeness and flag patterns.https://ctfpal.com/?tool=cipher-identifier
- Base64 decoder and encoder - Decode and encode Base64 and Base64-URL in the browser, with padding repair and automatic detection of nested encodings. Nothing is uploaded.https://ctfpal.com/?tool=base64-decoder
- Hex to text converter - Convert hexadecimal to text and back, tolerating whitespace, commas, and `0x` prefixes. Runs entirely in your browser.https://ctfpal.com/?tool=hex-decoder
- Base32 decoder and encoder - Decode Base32 (RFC 4648) to text or bytes, with padding repair. Distinguishes Base32 from Base64 and hex automatically.https://ctfpal.com/?tool=base32-decoder
- Binary to text converter - Convert binary (and decimal codepoints) to text and back. Handles 7-bit and 8-bit groupings, arbitrary separators, and reversed bit order.https://ctfpal.com/?tool=binary-to-text
Reading
- Spot the encoding: reading base64, base32, hex and friends at a glance - 5 min. Alphabet, length, and padding are enough to name almost any encoding on sight. A field guide to the encodings CTFs actually use, the magic prefixes that tell you what is underneath, and the traps that make a correct guess look wrong.
- The first ten minutes: a triage playbook for any CTF challenge - 8 min. Most challenges are lost to flailing, not to difficulty. Here is a repeatable order of operations for an unknown blob, an unknown file, and an unknown service - and the point at which you should stop guessing and start reading.
Practice set
Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.
- 2Warm - picoCTF 2019, easy
- Bases - picoCTF 2019, easy
- Binary Digits - picoCTF 2026, easy
- bytemancy 0 - picoCTF 2026, easy
- bytemancy 1 - picoCTF 2026, easy
- Codebook - Beginner picoMini 2022, easy
- convertme.py - Beginner picoMini 2022, easy
- FANTASY CTF - picoCTF 2025, easy
- interencdec - picoCTF 2024, easy
- Lets Warm Up - picoCTF 2019, easy
- MultiCode - picoCTF 2026, easy
- Nice netcat... - picoCTF 2021, easy
Checkpoint (gradeable)
Given a three-layer encoded string, produce the plaintext and state each layer in order.
Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.
Where the room gets stuck
The instinct students arrive with is to try decoders at random until one works. The habit worth building instead is to look at the alphabet first and predict the format before decoding - being right is the point, not the answer.
If you finish early
- Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
- Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
- Ask a student to break their own example - construct an input that defeats the tool, and explain why.