PricingFree tierFAQ Sign in
Host your CTF freeTalk to the event team

CTF encoder and decoder: Base64, hex, binary, URL, ROT13

Paste a strange string and decode it in one click, or encode your own text. Ten common CTF encodings, an auto-detect button for unknown input, and a recognition guide so you can tell them apart by sight. Everything runs in your browser.

Open the tool
Auto-detect UTF-8 safe Nothing uploaded
Encoder / decoder

Encode or decode text

Pick an encoding and a direction, or press Auto-detect if you don't know what you are looking at. Output updates as you type.

Direction
Output 

        

        

          

        

        

          
          
          
          
        

      


      
How to recognize each encoding

      

        

          
EncodingCharactersPadding / lengthTypical look

          
            
Base64A-Z a-z 0-9 + /Length is a multiple of 4; ends with = or == when paddedQ1RGe2hlbGxvfQ==

            
Base64 URL-safeA-Z a-z 0-9 - _Padding often droppedQ1RGe2hlbGxvfQ (seen in JWTs)

            
Hex0-9 a-fEven length; two digits per byte43 54 46 7b or 0x43

            
Binary0 1 and spacesGroups of 8 bits01000011 01010100

            
URL encodingNormal text plus %XXPercent sign followed by two hex digitshello%20world%21

            
HTML entities&name; &#NN; &#xHH;Each entity ends with a semicolon<b>

            
ROT13Letters only change; digits and symbols staySame length as the plaintextPGS{uryyb} (a flag-shaped string that is not CTF{)

            
ROT47Printable ASCII 33 to 126 all shiftSame length; digits and symbols change too%'7Lx style symbol soup

            
Decimal ASCIIDigits and separatorsNumbers mostly 32 to 12667 84 70 123

            
ReverseReadable characters, wrong orderSame length}olleh{FTC

          
        

      

    

  






  

    

      

        
Many CTF challenges hide a flag behind one or more layers of encoding. Encoding is not encryption: it has no key, so anyone can reverse it once they know which scheme was used. This tool converts between the encodings you meet most often, and its auto-detect button helps you work out which one you are facing.


        
How the encoder and decoder works

        
Choose an encoding, choose Decode or Encode, and type or paste into the input box. The output updates immediately. Text is converted to UTF-8 bytes first, so Base64, hex, binary and decimal handle accented letters and emoji correctly instead of failing on non-ASCII characters. If the input is not valid for the chosen decoder, an inline message explains the problem and the page keeps working.

        
The Swap button moves the output into the input box, which is handy for layered challenges: decode, swap, change the mode, decode again.


        
How auto-detect guesses

        
Auto-detect is a heuristic, not a guarantee. It checks, in order: only 0, 1 and spaces suggests binary; %XX sequences suggest URL encoding; &...; suggests HTML entities; an even number of hex digits suggests hex; the Base64 alphabet with a length divisible by four suggests Base64. Hex strings are also valid Base64 characters, so hex is tried first. If decoding gives unreadable bytes, the guess is rejected. ROT13 and Reverse cannot be detected reliably, so try them by hand.


        
Where encodings show up in CTFs

        
    
          
  • Beginner crypto and misc challenges often chain Base64, hex and ROT13 on purpose.
    • 
          
  • Web challenges use URL encoding and HTML entities in parameters, cookies and page source.
    • 
          
  • Forensics tasks hide data in hex dumps or binary strings.
    • 
          
  • JWT-style tokens use URL-safe Base64 for their segments.
    • 
        


        
Worked examples

        
Q1RGe2hlbGxvfQ== in Base64 decodes to CTF{hello}. The hex string 43 54 46 7b 68 69 7d decodes to CTF{hi}. Applying ROT13 to PGS{uryyb} gives CTF{hello}. A string such as Vm0wd2Q= may need several rounds, so decode, swap and repeat until the result is readable.


        
Tips

        
    
          
  • Look at the length and the last characters first. A trailing = almost always means Base64.
    • 
          
  • ROT13 only changes letters, and applying it twice returns the original.
    • 
          
  • If the result is gibberish, the data may be binary (an image or archive) rather than text, or it may be encrypted.
    • 
          
  • Keep a note of each layer so you can write it up later. See how to write a CTF writeup.
    • 
        


        
When to use this instead of CyberChef

        
For anything past a couple of layers, use CyberChef. It chains operations into a recipe, has hundreds of them (XOR, compression, ciphers, file carving), and its Magic operation tries far more encodings than this page's auto-detect. This page is for the quick case: one string, one of the common encodings, decoded in place with no recipe to build. It runs entirely in your browser and makes no network requests, and its UTF-8 handling means non-ASCII text round-trips cleanly. From a terminal, base64 -d, xxd -r -p and tr 'A-Za-z' 'N-ZA-Mn-za-m' cover the same ground.