Decode Base64
Unwrap an encoded string so you can read it. Encoding is not encryption.
Treat the decoded result as untrusted text. Do not run commands it contains.
Open recipe ↗toolbox / decode & inspect
Make the encoded bits readable.
CyberChef is one of those tools I keep coming back to. Decode a string, inspect a token, or tidy up an indicator without writing a throwaway script.
Open CyberChef ↗Self-hosted CyberChef 11.5.0. Opens in a separate workspace.
Try a guided case: What did the agent actually read? Copy a fictional tool response, check your output, and load its practice record into Trace Lab.
Starter recipes
Inspect a JWT
Read the payload of a JSON Web Token.
Decoding does not verify the signature, issuer, audience, or expiry. Avoid pasting live access tokens.
Open recipe ↗Defang a URL
Make an indicator less likely to become an accidental clickable link in a report.
Defanging changes presentation. It does not make a destination safe.
Open recipe ↗Extract URLs
Pull URL candidates out of text for closer inspection.
Extraction can miss obfuscated addresses. Do not visit unfamiliar links just to check them.
Open recipe ↗Decode URL encoding
Reveal percent-encoded characters in a URL or suspicious instruction.
Look for another encoding layer, but keep the original evidence unchanged.
Open recipe ↗Calculate SHA-256
Calculate a fingerprint for text or a file using CyberChef’s input panel.
A hash identifies bytes, not whether they are trustworthy. Text encoding and line endings affect it.
Open recipe ↗Advanced workflows
Small, repeatable investigation steps, not a one-click malware verdict. Start with the input format described on each card. Keep the original, inspect each layer, and never execute decoded content.
Adapted from upstream operation examples and community investigation patterns, with references on each card. These links contain recipes only, not malware samples or your input.
Script triage
Read an encoded PowerShell command
Recover the text from a conventional PowerShell encoded command without running it.
Input: Only the Base64 value following -EncodedCommand, not the whole command line.
Base64 → UTF-16LE text
This does not undo every obfuscation layer. Never paste the result into a shell. UTF-16LE applies to this command format, not every Base64 string.
Try a harmless example
Copy this input, then open the workflow. No real credentials or indicators are included.
VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAEgAZQBsAGwAbwAgAGYAcgBvAG0AIABhACAAaABhAHIAbQBsAGUAcwBzACAAcwBhAG0AcABsAGUAJwA=What to look for:
Write-Output 'Hello from a harmless sample'Layered encoding
Unwrap Base64-compressed text
Inspect compressed text hidden behind an encoding layer. Stop at the decoded output and decide what it is before doing anything else.
Input: A Base64 string whose decoded bytes are a gzip stream, often beginning H4sI.
Base64 → gzip decompression
Gzip is not raw DEFLATE or ZIP. A small compressed input can expand enormously; use small known samples and an isolated offline environment for untrusted archives.
Try a harmless example
Copy this input, then open the workflow. No real credentials or indicators are included.
H4sIAAAAAAAAA3NUyEgsys1JLS5WSM7PLShKLS5OTVHIyy9J1QMA7Cv9chsAAAA=What to look for:
A harmless compressed note.Batch analysis
Decode a list without mixing the records
Decode each record separately instead of treating a whole list as one encoded blob.
Input: One complete Base64 value per line. Remove blank lines first.
Fork on newline → decode each record → join with newlines
Errors are not suppressed. Decoded records can contain newlines, so preserve the original input if record boundaries matter.
Try a harmless example
Copy this input, then open the workflow. No real credentials or indicators are included.
SGVsbG8=
V29ybGQ=What to look for:
Hello
WorldIndicator handling
Decode, extract, and defang indicators
Turn an encoded text sample into a short indicator list suitable for a report. No destinations are contacted.
Input: One Base64-encoded text sample containing ordinary URLs.
Base64 → unique URL candidates → defang
The extractor can miss obfuscated or unusual URLs. Review the full decoded text as well. Defanging is not a safety verdict.
Try a harmless example
Copy this input, then open the workflow. No real credentials or indicators are included.
UmVmZXJlbmNlOiBodHRwczovL3NhbXBsZS5leGFtcGxlL25vdGU=What to look for:
hxxps[://]sample[.]example/noteBinary triage
Inspect hex as bytes, not executable code
See byte offsets and readable characters together when examining an embedded blob or a file header.
Input: Hexadecimal bytes, optionally separated by spaces. Not an address-prefixed hexdump.
Hex → bytes → offset and ASCII view
Recognizable headers are clues, not proof of file type or safety. This recipe neither runs nor disassembles the bytes.
Try a harmless example
Copy this input, then open the workflow. No real credentials or indicators are included.
48 65 6c 6c 6fWhat to look for:
Readable ASCII column: HelloBinary triage
Pull URL candidates from readable binary strings
A first pass over readable strings in a file, producing indicators you can examine without opening their destinations.
Input: A small file loaded with CyberChef’s file-input control, or raw byte input.
Printable strings → unique URL candidates → defang
This single-byte pass misses UTF-16 strings, encrypted content, and packed data. No results does not mean no indicators. Use an isolated offline environment for hostile files.
Try a harmless example
Copy this input, then open the workflow. No real credentials or indicators are included.
Harmless sample: https://sample.example/noteWhat to look for:
hxxps[://]sample[.]example/noteFor deeper investigation: Mattnotmax’s recipe collection and GCHQ’s explanation of Magic. Automatic guesses can be wrong. Community examples may include live indicators, hostile samples, or network operations; they are not bundled here.
Useful for agent security, too.
An instruction hidden in Base64 is still an instruction from an untrusted source. Decode it to examine the evidence, not to give it authority. Use Trace Lab’s reviewer to examine the surrounding agent run.
CyberChef is developed by GCHQ and contributors and released under the Apache 2.0 license. This is an independently hosted copy, not a GCHQ service or endorsement. Source, license, and offline download instructions ↗