Encoding and Decoding

Why encoding ≠ encryption

Encoding transforms data into a different representation — it has no key and is completely reversible by anyone. It is used for transport and display, not secrecy. CTF beginners often mistake encoded data for “encrypted” data — recognise the pattern and decode it immediately.

Base64

Base64 represents binary data as 64 printable ASCII characters (A–Z, a–z, 0–9, +, /). It always ends with = or == padding.

ZmxhZ3tIZWxsb1dvcmxkfQ==

echo "ZmxhZ3tIZWxsb1dvcmxkfQ==" | base64 -d
# flag{HelloWorld}

URL-safe Base64 uses - and _ instead of + and /.

Hexadecimal

Hex represents each byte as two characters (0-9, a-f):

666c61677b48656c6c6f576f726c647d

echo "666c61677b48656c6c6f576f726c647d" | xxd -r -p
# flag{HelloWorld}

# Python:
bytes.fromhex("666c61677b...").decode()

URL encoding

Spaces become %20, { becomes %7B, etc.:

flag%7BHello%20World%7D

python3 -c "from urllib.parse import unquote; print(unquote('flag%7BHello%7D'))"

Binary

8 bits per character, space-separated:

01100110 01101100 01100001 01100111

bits = "01100110 01101100 01100001 01100111"
print(''.join(chr(int(b, 2)) for b in bits.split()))

ROT47 and other rotations

ROT47 is like ROT13 but applies to all 94 printable ASCII characters (codes 33–126). Useful when the text contains punctuation.

# CyberChef → ROT47 operation, or:
python3 -c "
s = 'E=6]6I2>A=6]4@>'
print(''.join(chr((ord(c)-33+47)%94+33) for c in s))
"

The CyberChef Magic trick

Paste any mystery string into CyberChef → Magic operation → turn on Intensive mode. It tries hundreds of combinations and highlights outputs that look like flags. Use this before spending time decoding manually.

Recognition table

Pattern	Encoding
Ends with =, only A-Z a-z 0-9 +/	Base64
All 0-9 a-f, even length	Hex
%XX sequences	URL encoding
Only 0 and 1, groups of 8	Binary
Only . and -	Morse
Only A-Z, looks Caesar-shifted	ROT13/Caesar