Cipher identifier and automatic decoder
Paste anything and find out what it is. ctfpal runs every decoder and rotation, including multi-pass cascades, and ranks results by English-likeness and flag patterns.
Open in ctfpalThis is the tool to reach for when you do not yet know what you are holding. It applies every decoder ctfpal knows - hex, Base64, Base32, binary, decimal codepoints, Morse, URL, HTML entities, Atbash, all 26 rotations - and then applies them again to each result, several layers deep, scoring every intermediate value.
How candidates are ranked
- Chi-squared against English letter frequencies, the same statistic the Caesar solver uses.
- Common-word scoring - a result containing
the,and,flagoutranks one that merely has plausible letter frequencies. - Flag-pattern bonus - anything matching the shape
word{...}jumps to the top, because in this context that is almost never a coincidence. - Printability - results that decode to control characters are demoted rather than discarded, since binary payloads are still worth surfacing.
When it comes back empty
No high-scoring candidate means the input is not a simple encoding of English. That is information, not failure. The usual next branches: a keyed cipher (try Vigenere key recovery or the substitution solver), a hash (check the hash identifier), or bytes rather than text (check the magic byte table and switch to File mode).
Common questions
- How deep does the cascade go?
- Several layers, with pruning: a branch is abandoned once its intermediate value stops looking like a plausible encoding, which keeps the search from exploding while still catching the common two- and three-layer wrappers.
- Will it identify a cipher it cannot break?
- Partly. Structural tells - a transposition’s normal letter frequencies, a Vigenere’s index of coincidence - are reported even when no decryption is produced, which points you at the right specialised tool.