Encoding (Base64 and Hex)

Before ciphers and encryption, you need encoding. Encoding is not encryption. It is a way to write the same bytes as text so they can travel through systems that expect text.

In CTFs, a lot of "crypto" is one or two clean decodes.

Core idea

Start by identifying how the data is written. A string is encoding-shaped when its characters, length, or padding match a known format:

• 626974637466 is hex-shaped because it uses only 0-9 and a-f and splits into pairs.
• Yml0Y3Rm is Base64-shaped because it uses the Base64 alphabet; longer values may end with = padding.
• meet at nine is already readable text, so there is no reason to decode it as hex or Base64.

These clues identify the outer representation, not what the bytes mean. Base64 or hex can contain readable text, encrypted data, compressed data, or a file. Decode one layer, inspect the result, and then decide what the bytes are.

Encoding vs encryption

• Encoding changes representation so data can be stored or sent. Anyone who knows the format can reverse it. There is no key.
• Encryption hides data using a key. You need that key, or a weakness in how it was used.

If the characters and padding match a known encoding, test that representation before assuming encryption.

Quick comparison

These patterns suggest a format; they do not prove it. Decode one layer and inspect the result before choosing another operation.

Base64

Standard Base64 uses A-Z, a-z, 0-9, +, /, and = padding. It turns binary into text for things like cookies, JSON, and email. URL-safe Base64 (sometimes called base64url) uses - and _ instead of + and /, and may omit the = padding.

Base64 clues

• The alphabet is mostly letters and digits, sometimes with + / or - _.
• With padding present, the length is a multiple of 4, and = only appears at the end (= or ==).
• Missing padding is still Base64-shaped. Some tokens and cookies drop the =.
• Example: Yml0Y3Rme3tleGFtcGxlfX0= decodes to bitctf{{example}}.

If the string matches these clues, decode it once and inspect the result.

Decode Base64

echo Yml0Y3Rme3tleGFtcGxlfX0= | base64 -d

atob("Yml0Y3Rme3tleGFtcGxlfX0=")

import base64

base64.b64decode("Yml0Y3Rme3tleGFtcGxlfX0=")

The Bash command works with GNU coreutils and current macOS; older macOS versions use base64 -D. Browser atob(...) handles the standard alphabet but not - and _. In Python, use base64.urlsafe_b64decode(...) for URL-safe input and add = padding until the length is a multiple of 4 if required.

In CyberChef, add From Base64 to the recipe.

Hex

Hex writes each byte as two characters from 0-9 and a-f (or A-F). You will see it in dumps, some challenge files, and hash output.

Hex clues

• Hexadecimal uses sixteen characters: 0-9 and a-f (or A-F). One byte is written as two hex characters, so a value representing whole bytes has even length.
• Example: 6269746374667b7b6578616d706c657d7d decodes to bitctf{{example}}.

Split the example into pairs to see the bytes:

62 69 74 63 74 66 7b 7b 65 78 61 6d 70 6c 65 7d 7d

A long hex string is "hex-shaped." After one decode it might be readable text, another encoding, a hash, or binary. The decode tells you which.

Decode hex

echo 6269746374667b7b6578616d706c657d7d | xxd -r -p

const hex = "6269746374667b7b6578616d706c657d7d";
const bytes = Uint8Array.from(
  hex.match(/../g).map(byte => Number.parseInt(byte, 16)),
);

new TextDecoder().decode(bytes);

bytes.fromhex("6269746374667b7b6578616d706c657d7d").decode()

Use .decode() when the resulting bytes contain text.

In CyberChef, add From Hex to the recipe. You can also inspect individual values with a hex-to-ASCII converter.

After decoding

The output decides your next move:

Worked example

A challenge gives you:

NmM2MTc5NjU3MjczNWY2MTcyNjU1ZjYzNmM3NTY1NzM=

Work through the evidence in order:

1. The alphabet and final = make standard Base64 a reasonable first test.
2. Decode Base64 once and inspect the result:

6c61796572735f6172655f636c756573

3. The new value uses only hex digits, has even length, and splits into pairs. Decode it as hex:

layers_are_clues

Each operation was supported by the current value. You did not decide in advance to "decode twice"; you classified the output after the first decode.

Common mistakes

• Calling every unfamiliar string encryption before checking its alphabet and padding.
• Repeating decoders without inspecting the output between operations.
• Assuming every hex-shaped value must decode to text. Hashes, file bytes, and encrypted data are often displayed as hex too.

Useful resources

• Python base64 docs
• RFC 4648 if you want the actual Base64 and hex alphabets

Self-check

A cookie contains:

eyJyb2xlIjoidmlld2VyIn0

It has letters and numbers but no =, +, or /. Is Base64 still a reasonable first test?

Answer: yes. URL-safe Base64 may omit padding. Add = until the length is a multiple of 4 if the decoder complains, then see whether the bytes look like JSON or other text.

Next

National Treasure Fragment