Encoding is not encryption: recognizing and chaining decodings

You hit a weird string —in a CTF, a log, a suspicious macro— and many people's first reaction is "it's encrypted, nothing to do without the key". That's almost always false: it isn't encrypted, it's encoded, and that reverses with no key at all. Telling the two apart is one of the first things separating whoever solves the challenge from whoever gets stuck.

Three concepts people mix up

• Encoding: Base64, hex, URL-encoding, ROT13… It only changes the representation. Reversible by anyone, no key. Adds no confidentiality.
• Encryption: AES, ChaCha20, XOR with a key… Reversible only with the key. That actually protects the content.
• Hashing: MD5, SHA-256… It's one-way: you don't "decrypt" it. You guess the input (brute force / dictionary).

Recognize the encoding by its shape

You don't need to guess: each encoding has a visual fingerprint.

• Base64: alphabet A–Z a–z 0–9 + /, length a multiple of 4, sometimes = padding at the end. base64url uses - and _.
• Hex: only 0–9 a–f, even length. Often in pairs (48 65 6c 6c 6f).
• URL / percent: %XX everywhere (%2F, %20).
• ROT13 / Caesar: looks like text but "shifted" (Uryyb → Hello).
• Binary / decimal: groups of 0/1 or separated numbers landing in the ASCII range (32–126).

SGVsbG8=            → Base64  → "Hello"
48656c6c6f          → Hex     → "Hello"
%3Cscript%3E        → URL     → "<script>"
Uryyb               → ROT13   → "Hello"

The CTF trick: they're nested

It's rarely a single layer. The classic is Base64 inside hex inside ROT… The strategy is mechanical: decode one layer, look at the result and ask "is this readable text or a new known shape?". If it's another shape, repeat. If it's noise, maybe it's no longer encoding but encryption (see below).

What if it really is encrypted?

If after peeling every encoding layer you still see noise, there's probably encryption. In CTFs the usual suspect is XOR with a short or repeating key: you attack it with analysis (key length, frequencies, known-plaintext like FLAG{). At that point "decode" no longer works: it's cryptanalysis. But half the "crypto" challenges fall before you get here, the moment you realize it was just Base64 wearing a hat.

Not just for CTFs

This is real triage: malware obfuscates its payloads with Base64/hex/XOR to dodge a quick read and some AVs. Recognizing the shape speeds up analysis — that's why the Cron Analyzer flags base64 -d | sh and the curl | sh pattern as alarms: they're the "inline" version of this same game.

Checklist

• ✅ Encoding, encryption or hash? (reversible without a key / with a key / one-way)
• ✅ Identify the shape: alphabet and length give away Base64, hex, URL, ROT…
• ✅ Decode layer by layer; readable text or a new shape?
• ✅ Still noise after every layer? Suspect XOR/encryption
• ✅ In triage: Base64/hex/XOR = typical payload obfuscation

"It's encrypted" is the excuse; "it's Base64 three times over" is the reality, more often than you'd think. Learn to read the shape and you'll stop asking for a key that was never needed.

Sergio Belmonte Morales
Cybersecurity Analyst · SOC · Sentinel/KQL specialist