How deep does the cascade go?

Several layers, with pruning: a branch is abandoned once its intermediate value stops looking like a plausible encoding, which keeps the search from exploding while still catching the common two- and three-layer wrappers.

Will it identify a cipher it cannot break?

Partly. Structural tells - a transposition’s normal letter frequencies, a Vigenere’s index of coincidence - are reported even when no decryption is produced, which points you at the right specialised tool.

All tools

Classical cryptoRuns locallyNo account

Cipher identifier and automatic decoder

Paste anything and find out what it is. ctfpal runs every decoder and rotation, including multi-pass cascades, and ranks results by English-likeness and flag patterns.

Open in ctfpal

This is the tool to reach for when you do not yet know what you are holding. It applies every decoder ctfpal knows - hex, Base64, Base32, binary, decimal codepoints, Morse, URL, HTML entities, Atbash, all 26 rotations - and then applies them again to each result, several layers deep, scoring every intermediate value.

How candidates are ranked

Chi-squared against English letter frequencies, the same statistic the Caesar solver uses.
Common-word scoring - a result containing the, and, flag outranks one that merely has plausible letter frequencies.
Flag-pattern bonus - anything matching the shape word{...} jumps to the top, because in this context that is almost never a coincidence.
Printability - results that decode to control characters are demoted rather than discarded, since binary payloads are still worth surfacing.

When it comes back empty

No high-scoring candidate means the input is not a simple encoding of English. That is information, not failure. The usual next branches: a keyed cipher (try Vigenere key recovery or the substitution solver), a hash (check the hash identifier), or bytes rather than text (check the magic byte table and switch to File mode).

Common questions

How deep does the cascade go?: Several layers, with pruning: a branch is abandoned once its intermediate value stops looking like a plausible encoding, which keeps the search from exploding while still catching the common two- and three-layer wrappers.
Will it identify a cipher it cannot break?: Partly. Structural tells - a transposition’s normal letter frequencies, a Vigenere’s index of coincidence - are reported even when no decryption is produced, which points you at the right specialised tool.

Part of a module

1. Recognising encodings

Tell Base64 from hex from Base32 from binary on sight, peel layered encodings, and learn why an encoding is not encryption.

Practise on real challenges

Go deeper

The first ten minutes: a triage playbook for any CTF challengeMost challenges are lost to flailing, not to difficulty. Here is a repeatable order of operations for an unknown blob, an unknown file, and an unknown service - and the point at which you should stop guessing and start reading.
Spot the encoding: reading base64, base32, hex and friends at a glanceAlphabet, length, and padding are enough to name almost any encoding on sight. A field guide to the encodings CTFs actually use, the magic prefixes that tell you what is underneath, and the traps that make a correct guess look wrong.