Challenge Tools
Originally built for picoCTF writeups, but feel free to use them anywhere else.
Solvers
Recipe Chain
Stack decoders into a pipeline: Base64, hex, ROT, XOR, Morse, URL, Atbash, Vigenère, and more. Magic mode auto-discovers the chain. Bookmark the URL to save it.
Stegall
Drop any file and Stegall runs every applicable steg technique in parallel: LSB sweeps, bit planes, spectrograms, polyglot carving, metadata, whitespace decode, and a 6-layer base/ROT/XOR/zlib cascade. Recursively unpacks results and surfaces flag matches.
Pwntools Forge
Generate a complete pwntools exploit script from a template: ret2win, shellcode, ret2libc, ROP chain, format string, or blank scaffold. Fill the form, copy or download the .py file. Fully editable before saving.
Encoding & Bases
Base64 & Base32 Decoder
Decode Base64 and Base32 strings with auto-detection. Multi-layer mode unwraps nested encodings automatically.
Number Base Converter
Convert numbers between binary, octal, decimal, and hexadecimal instantly. Enter any value and see all four bases update in real time.
Binary to Hex Converter
Normalize binary strings and convert them instantly to hexadecimal, decimal, and octal.
URL Encoder / Decoder
Encode and decode URL-encoded (percent-encoded) strings. Useful for web exploitation challenges involving query parameters, form data, and HTTP headers.
Morse Code Decoder
Decode Morse code to plain text or encode text to Morse code. Supports all letters, digits, and common punctuation.
Classical Ciphers
ROT / Caesar Cipher
Decode Caesar-shifted and ROT-encoded text. Drag the shift slider or scan all 26 rotations at once.
Vigenère Cipher
Encrypt or decrypt text with the Vigenère polyalphabetic substitution cipher using a keyword.
Affine Cipher
Encrypt, decrypt, or brute-force affine ciphers using E(x) = (ax + b) mod 26. Brute force ranks all 312 key pairs by English letter frequency.
Frequency Analysis
Analyze letter frequencies in a substitution cipher and interactively build the decryption mapping with auto-filled guesses.
Cipher Identifier & Auto-Decoder
Paste any ciphertext and the tool auto-runs every common decoder (base64, hex, Morse, ROT, Atbash, Bacon, binary, decimal, URL) and ranks the results by English-likeness.
Atbash Cipher
Encode or decode the Atbash mirror cipher (A↔Z) in one click. Self-inverse, no key required.
Rail Fence Cipher
Encrypt or decrypt rail fence (zigzag) transposition ciphers. Brute-force across rail counts and offsets to find the right setting fast.
Bacon Cipher
Decode Baconian A/B ciphers, including hidden-bit case and vowel encodings where each letter carries one bit.
Modern Crypto
XOR Cipher
XOR-decrypt hex or text ciphertext with a known key, or brute-force the single-byte key automatically.
RSA Calculator
Decrypt RSA ciphertexts, factor n from the sum of primes, or generate key parameters. Handles arbitrarily large BigInt values.
Hash Identifier
Identify unknown hash types by length and prefix. Covers MD5, SHA-1, SHA-256, SHA-512, bcrypt, NTLM, and more.
Checksum Calculator
Compute CRC32, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for text or uploaded files. Verify against known hashes.
AES Decryptor
Decrypt AES-CBC, AES-GCM, AES-CTR, and AES-ECB ciphertexts with a known key and IV. Hex / base64 / UTF-8 inputs, AES-128/192/256, PKCS#7 padding.
Forensics
File Magic Identifier
Identify file types from magic numbers. Paste hex bytes or drop a file to detect PNG, JPEG, ZIP, PDF, ELF, PCAP, SQLite, and dozens of other formats.
Image Metadata Viewer
Read EXIF, XMP, JPEG comments, and PNG tEXt / iTXt / zTXt chunks from images entirely in the browser. Highlights flag-like values.
Strings Extractor
Pull printable text from any binary, library, or image. ASCII and UTF-16 detection, configurable minimum length, flag-like highlight, no command line needed.
QR Code & Barcode Decoder
Decode QR codes, Data Matrix, Aztec, PDF417, and 1D barcodes from any uploaded image. Browser-native, no upload to a server.
Password Steg (Encrypt & Decrypt)
Password-protect a message with AES-GCM and PBKDF2-derived keys. Encode produces a base64 ciphertext you can hide in any carrier; decode recovers the original with the same password. Runs entirely in the browser.
Binary & Data
Binary Calculator
Perform binary arithmetic (add, subtract, multiply, divide) with copyable outputs in every base.
Bit Shift Calculator
Perform left/right bit shifts and see the result across binary, octal, decimal, and hex.
Endianness Converter
Convert between big-endian and little-endian byte order with visual byte layout. Supports 16-bit, 32-bit, and 64-bit words.
Hex Viewer
View text or raw hex bytes as a xxd-style hex dump with byte offset, hex columns, and ASCII sidebar. Highlights printable characters and null bytes.
Binary Search
Visualize the halving strategy used in picoCTF's Binary Search challenge.
Binary Exploitation
Cyclic Pattern Generator
Generate de Bruijn cyclic patterns and find buffer overflow offsets. The browser equivalent of pwntools cyclic and cyclic_find.
pwntools Payload Builder
Pack integers into little-endian bytes (p32 / p64), unpack bytes back to integers, and build flat ROP payloads with offset-based insertion.
Web
Regex Tester
Test regular expressions against a string with live match highlighting, flag toggles, and common CTF pattern shortcuts.
JWT Decoder
Decode JSON Web Tokens and inspect the header, payload, and signature. Useful for web exploitation challenges.
Timestamp Converter
Convert Unix timestamps (seconds or milliseconds), hex timestamps, and date strings to every common format.
Flask Session Decoder
Decode Flask / itsdangerous session cookies. Splits payload, decompresses zlib, parses JSON, and verifies the HMAC signature when given the secret.
Reverse Shell Generator
Generate reverse shell payloads (bash, nc, python, perl, ruby, php, node, powershell) and matching listeners. Set host and port once, copy any variant.