Base64, hex and URL decoder
Paste an encoded string from a log, an email or a script and the tool works out the format, decodes it and shows the text or a hex dump. It also works the other way round – encoding text.
How to use it
- Copy the encoded string – for example the value after -EncodedCommand in a process log, part of a link from a suspicious email, or a value from an HTTP request.
- Paste it into the box and click Decode. Spaces, line breaks and missing = padding are fine.
- If the tool can't tell the format, or picks a different one from what you expect, choose it yourself under Format.
- Copy the result as text or as hex. To go the other way, type some text and click Encode text.
How it works
Encoded strings turn up at every step of incident analysis: a PowerShell command hidden behind -EncodedCommand, data in a link from a phishing email, an attachment, or the body of an HTTP request in a web server log. Encoding doesn't encrypt anything – it just changes how data is written, which is exactly why attackers use it to make malicious content less obvious at first sight.
The tool supports these formats:
- Base64 – 64 characters (A–Z, a–z, 0–9,
+,/) with=padding at the end, as defined in RFC 4648. The most common way to send binary data as text (email attachments, data in HTML, scripts). - Base64URL – the variant used in URLs and JWTs. It uses
-and_instead of+and/and often drops the padding. - Hexadecimal (hex) – every byte as two digits 0–9 and a–f. Spaces, colons,
0xand\xare all accepted. - URL encoding – sequences such as
%2For%C5%99as defined in RFC 3986, with+treated as a space (web forms).
The result is decoded as UTF-8 text. If every other byte is zero, the tool recognises UTF-16LE, which PowerShell uses. If the result isn't text, it shows a hex dump and guesses the file type from the first bytes ("magic bytes") – a Windows executable, ZIP, PDF, an image and more.
FAQ
Is the text I paste sent anywhere?
No. Decoding and encoding run as a script in your browser. Nothing is sent to a server or stored. Even so, avoid pasting passwords and keys into any web tool unless you have to.
Is Base64 encryption?
No. Base64, hex and URL encoding only change how data is written so it can pass through systems that handle text. There's no key, and anyone can decode them. Attackers use them to hide commands from a quick glance, not from analysis.
Why does a decoded PowerShell command have a zero or a gap between every letter?
According to Microsoft's documentation, -EncodedCommand expects Base64 of a UTF-16LE string, where every character takes two bytes. The tool recognises this and shows the text normally. When encoding by hand, use the Base64 of UTF-16LE row.
What are layers?
Attackers often encode more than once – hex inside Base64, for example. In Detect automatically mode the tool keeps decoding while the result still looks like encoded text (up to five layers) and shows each layer separately. If you pick a format yourself, it decodes just one layer.
The result is a file, not text. What now?
The tool shows a hex dump and guesses the file type from the first bytes (a Windows executable starts with "MZ", for example). Don't open such a file on an everyday computer. Copy the hex and analyse it in an isolated environment.
Sources
Updated