Base64 decoder and encoder

Base64 packs three bytes into four printable characters. It is the single most common wrapper in capture-the-flag: challenge authors reach for it because it survives copy-paste, email, and JSON, and because it looks encrypted to a beginner while being nothing of the sort. Base64 is an encoding, not a cipher - there is no key, and decoding it is not an attack.

How to recognise it

• The alphabet is A-Z, a-z, 0-9, +, /, with = only ever at the end.
• The length is a multiple of 4 once padding is included. One = means the last group carried two bytes, two = means one byte.
• See - and _ instead of + and /? That is Base64-URL, used in JWTs and query strings, and it usually drops padding entirely.
• All-uppercase with no lowercase and lots of = is more likely Base32.

A useful tell: English text encoded to Base64 is longer than the plaintext by exactly a third. If a blob is 44 characters, the payload is 32 bytes - which is also the length of a SHA-256 digest, and a hint worth following.

Layered encodings

Challenge authors rarely stop at one layer. Base64 of hex of Base64 is a standard trick, and decoding by hand three times is exactly the friction ctfpal removes: the cipher identifier runs every decoder in cascade and ranks the results by how much they look like English, so a three-layer wrapper resolves in one click instead of three round trips through a website.

$ echo 'VmpGb2QxTXlSblJTYTJoUVVrWmFUMVpyVm5kaQ==' | base64 -d
VjFod1MyRnRSblRSa2hQUkZaT1ZrVndkaQ==
$ echo 'VjFod1MyRnRSblRSa2hQUkZaT1ZrVndkaQ==' | base64 -d
...and so on, until it stops looking like Base64

Decoding to bytes, not text

If the decode produces mojibake, the payload was never text. Check the first bytes against the magic byte table: PK is a ZIP, \x89PNG is an image, \x1f\x8b is gzip. In that case, decode the Base64 to a file and switch to File mode rather than fighting the text view.