Base64 & Base32 Decoder

How it works

Base64 encodes binary data as printable ASCII using a 64-character alphabet (A-Z, a-z, 0-9, +, /). The output is padded to a multiple of four characters with =. Base32 uses only uppercase letters and digits 2-7, making it safe for case-insensitive systems.

Some CTF challenges nest multiple layers of Base64 - encode once, then encode that output again, and so on. The Multi-layer mode handles this automatically.

Challenges solved with this tool: picoCTF 2023 - Repetitions, picoCTF 2023 - ReadMyCert.

The standard Base64 alphabet uses A-Z, a-z, 0-9, +, and /. A URL-safe variant replaces + with - and / with _ so the encoded string is safe to include in URLs and filenames without further escaping. JWTs, for instance, always use URL-safe Base64 with padding stripped.

In CTF challenges, Base64 is one of the first encodings to recognize. Giveaways include a string that ends with one or two = padding characters, an alphabet limited to letters, digits, +, and /, and a length that is a multiple of four. Base32 is recognizable by its all-uppercase alphanumeric characters with = padding and a length that is a multiple of eight.

The multi-layer mode is particularly useful when a challenge recursively applies encoding. This technique appears in CTF forensics challenges that encode a flag, then encode the resulting string again several times over. Each round of the Multi-layer decoder peels away one Base64 layer until the output is no longer valid Base64, at which point the decoding stops and the plaintext (often the flag itself) is displayed. Challenges like Repetitions apply exactly six layers of Base64, which this mode handles in one click.

One common edge case: some encoders omit the trailing = padding. If a string looks like Base64 but fails to decode, try appending one or two = characters to pad it to a multiple of four. The tool handles this automatically.