Encodings
Encodings convert data representation without providing cryptographic security. They are used to safely transmit, store, or display binary data as text. In CTFs, encodings are stacked to confuse solvers and obscure flags.
Common objective: identify each encoding layer > decode > repeat until plaintext or flag appears.
Example:
UGF5bG9hZCBpcyBjb21wbGV0ZWx5IGJhc2U2NCBlbmNvZGVkLg==
Decoded: “Payload is completely base64 encoded.”
| Encoding | Alphabet / Structure | Recognition Hints |
|---|---|---|
| Base64 | A–Z a–z 0–9 +/ (= for padding) | Ends with = / ==. ASCII letters + slashes |
| Base32 | A–Z 2–7 | Uppercase letters and digits 2–7, often ends with = |
| Base58 | BTC alphabet (excludes 0 O l I) | No +/=, mixed case letters & digits |
| Base85 / Ascii85 | ASCII 33–117, <~ … ~> |
<~ prefix |
| Base91 | Compact form, 94 printable chars | No padding, very dense string |
| Base100/256/65536 | Emoji or Unicode characters | Non‑ASCII glyphs, emojis, Chinese chars, text looks odd |
| URL‑encoding | %20, %41, +: space |
Percentage signs |
| Hex | 0–9 A–F pairs | Even length, only hex digits |
| Binary (ASCII) | 0 / 1 (8‑bit groups) | Only 0s and 1s, usually multiple of 8 |
| Octal | 0–7 digits | Text of 7 and 3 digits separated by spaces |
| Unicode/UTF‑16 | Null bytes between letters (h\x00i\x00) |
Appears in hexdumps/UTF‑16 files |
| MIME/Quoted‑Printable | =XX hex sequences |
Email style encoding |
-
Inspect text pattern
- Ends with
=: Base64/Base32. - Only 0–9A–F: Hex.
%20,%3D: URL encoded.- Binary (0/1 bytes): ASCII binary or bit cipher.
- Ends with
-
Use automated detectors
-
Apply layer‑by‑layer logic
- Always decode one layer > inspect > repeat:
echo "<string>" | base64 -d | xxd -p -r
| Tool | Purpose |
|---|---|
| CyberChef | Universal encode/decode platform (Magic auto‑detect) |
| Better‑Converter Base65536 | Base65536 encoder and decoder |
xxd |
Hex dump <> Binary converter |
iconv |
Change text encodings (UTF‑16 <> UTF‑8) |