Encoding & Crypto Toolkit

Multi-format encoder/decoder (Base64, Hex, URL, HTML entities, PowerShell -enc), classical cipher solver, payload obfuscation chainer, JWT attack selector, and CLI reference. All processing client-side.

#Encoding

#Multi-Format Encoder / Decoder

5 encoding formats (Base64, Hex, URL, HTML entities, PowerShell -enc) with encode/decode, swap, copy. Includes CLI command equivalents for each operation.

Input
Output

#Cipher Analysis

#Classical Cipher Identifier & Solver

Auto-detection via Index of Coincidence + solver for Caesar, Vigenere, Atbash, Rail Fence, Morse, Binary/Hex. Ideal for CTF challenges.

Classical Cipher Identifier & Solver

Paste ciphertext to auto-identify, then switch to the solver tab for the detected cipher.

Auto-Identifier

IC: -
Length: -
Charset: -
Alpha only: -

CTF Cipher Cheatsheet

Cipher Indicator Key needed Tool
Caesar Only letters, shifted alphabet, high IC Number 0-25 This widget
ROT13 Caesar key=13, common in forum spoilers None (fixed) This widget
Atbash Letters only, Z↔A substitution None (fixed) This widget
Vigenere IC ~0.04-0.055, letters only, repeating key Word / phrase This widget
Rail Fence IC ~same as plaintext, transposition Rail count (2-10) This widget
Base64 Ends in =, alphanumeric + / only None This widget / CyberChef
Hex encoded Only 0-9a-f, even length None This widget
Morse Only . - / space characters None This widget
Binary Only 0/1, groups of 5-8 bits None This widget
XOR Binary-looking, repeating byte pattern Key (try 1 byte) CyberChef
RSA Very large numbers, n/e/c given Math (factor n) RsaCtfTool
AES Hex blob, key given, block-aligned Key + IV CyberChef

#Payload Engineering

#Payload Obfuscation Chainer

Visual pipeline: chain base64, XOR, gzip, ROT13, URL encode, PowerShell Base64... Presets for AMSI bypass, webshell obfuscation, XSS double-encoding.

Payload Obfuscation Chainer

Build a pipeline of transformations applied sequentially. Each layer receives the output of the previous one.

0 bytes
Input → Layer 1 → Layer 2 → ... → Output
No layers added yet. Add a layer below.
Notes
  • - Layering increases AV evasion but also increases payload size and complexity.
  • - XOR + Base64 is a common malware technique (detected by most AVs at signature level).
  • - PowerShell -EncodedCommand expects UTF-16LE Base64 (use the PS Base64 layer).
  • - Multiple base64 rounds are trivially decoded by any automated tool.

#JWT Attack Selector

Beyond simple decoding: identifies the algorithm and suggests all applicable attacks (alg:none, key confusion RS->HS, brute force secret, kid injection, jku injection, embedded JWK) with ready-to-use forged tokens.

JWT Attack Selector

Paste a JWT to decode it and generate exploit payloads for every applicable attack.

#CLI Reference

#Base64

# Encode
echo -n "hello world" | base64
# aGVsbG8gd29ybGQ=

# Decode
echo "aGVsbG8gd29ybGQ=" | base64 -d
# hello world

# Encode file
base64 payload.bin > payload.b64
cat payload.bin | base64 -w0  # no line wrap

# Decode file
base64 -d payload.b64 > payload.bin

# PowerShell
[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("hello"))
[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aGVsbG8="))

#Hex

# Encode
echo -n "hello" | xxd -p
# 68656c6c6f

# Decode
echo "68656c6c6f" | xxd -r -p
# hello

# File to hex
xxd payload.bin
xxd -p payload.bin  # plain hex

# Hex to file
xxd -r -p hex.txt > payload.bin

# Python
python3 -c "print('hello'.encode().hex())"
python3 -c "print(bytes.fromhex('68656c6c6f').decode())"

#URL Encoding

# Python
python3 -c "from urllib.parse import quote; print(quote('hello world&foo=bar'))"
# hello%20world%26foo%3Dbar

python3 -c "from urllib.parse import unquote; print(unquote('hello%20world'))"

# curl auto-encodes with --data-urlencode
curl -G --data-urlencode "q=hello world" https://example.com/search

#PowerShell Encoded Command

PowerShell -EncodedCommand expects UTF-16LE Base64. NOT standard Base64.

# Encode a command
$cmd = 'Write-Host "Hello"'
$bytes = [Text.Encoding]::Unicode.GetBytes($cmd)
$enc = [Convert]::ToBase64String($bytes)
powershell -ep bypass -enc $enc

# Decode
$dec = [Text.Encoding]::Unicode.GetString(
  [Convert]::FromBase64String("VwByAGkAdABlAC0A..."))

# Linux: encode for PS
echo -n 'Write-Host "Hello"' | iconv -t utf-16le | base64 -w0

# Linux: decode PS encoded
echo "VwByAGkA..." | base64 -d | iconv -f utf-16le

#HTML Entities

# Python encode
python3 -c "print(''.join(f'&#{ord(c)};' for c in 'hello'))"
# hello

# Common entities
# &lt;   <      &gt;   >
# &amp;  &      &quot; "     &#39;  '

# XSS payload encoding
# <script> -> &#60;&#115;&#99;&#114;&#105;&#112;&#116;&#62;

#Encoding Chains

# Chain: text -> base64 -> hex
echo -n "payload" | base64 | xxd -p

# Chain: text -> url -> base64
python3 -c "
from urllib.parse import quote
from base64 import b64encode
s = quote('cmd /c whoami')
print(b64encode(s.encode()).decode())
"

# Common offensive chains:
# XSS:  payload -> HTML entities
# SQLi: payload -> URL -> double URL encode
# PS:   command -> UTF-16LE -> Base64 (-enc)
# Web:  payload -> Base64 -> URL encode

#Hashing

#Hash Calculator

Compute MD5 / SHA-1 / SHA-256 / SHA-512 and more of any input, with copyable output.

Hash Calculator

#Also See

#Official Resources

#Cyber Aurelien Guidi