Log Deobfuscator: Hex, Base64 & PowerShell Decoder

Command lines captured by EDR, web server logs and email headers often contain credentials, internal hostnames or customer data alongside the payload. Pasting them into a random online URL decoder or Base64 decoder copies that data to a third party. Everything here runs in the page, which also makes it safe on air-gapped analysis workstations.

The output panel renders decoded text as inert text, never as HTML, and nothing is executed. Treat decoded URLs and commands as live indicators: defang them before sharing (the IOC Extractor does this in one click).

A typical triage loop looks like this: copy the suspicious field from the SIEM, paste it here, let auto-detect name the encoding, and read the plain-text result. If the output is still unreadable, the detector status line tells you which layer it stopped at, and you can force a specific decoder from the mode buttons. When the payload is fully unwrapped, copy it into your case notes and extract indicators from it.

PowerShell’s -EncodedCommand (also abbreviated -enc, -e or -ec) takes a script encoded as UTF-16LE bytes and then Base64. A plain Base64 decode of these strings shows every character followed by a null byte, which is why “powershell base64 decode” output from generic tools looks like I.E.X. .(.N.e.w.. Choose the PowerShell mode, or paste the whole command line, and the tool extracts the argument and decodes it as UTF-16LE.

Attackers frequently nest layers: an encoded command that calls [Convert]::FromBase64String on a gzip stream, which contains another script. Enable Decode recursively to unwrap until the result stops changing.

• To produce an encoded command for testing: [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($script)).
• Watch for IEX, DownloadString, FromBase64String, -w hidden and -nop; these are common in loader one-liners.

Hexadecimal to ASCII conversion turns each pair of hex digits into one byte: 48 65 6c 6c 6f is “Hello”. The hex to string decoder accepts spaces, colons, commas, 0x prefixes and \x escapes, and decodes the bytes as UTF-8 so multibyte characters survive.

URL encoding replaces unsafe characters with % and two hex digits (%2F is /). Web logs and phishing links often double-encode (%252F), so an online URL decoder that runs once may leave work undone. Recursive mode handles this.

Base64 encodes every 3 bytes as 4 characters from a 64-character alphabet, padding the end with =. URL-safe Base64 (used by JWTs) swaps +/ for -_ and drops the padding; the decoder accepts both forms. Use the Encode direction for Base64 encode tasks such as building test fixtures.

Gzip data always starts with the magic bytes 1F 8B; Base64-encoded gzip therefore starts with H4sI. When auto-detect sees that prefix it decodes the Base64 and pipes the bytes through DecompressionStream("gzip"). This is the same gunzip operation as gunzip on the command line, done entirely in the browser.

CyberChef is GCHQ’s open-source “Cyber Swiss Army Knife”: hundreds of operations chained into recipes. It is excellent, but large, and many teams only use a handful of its operations. This workbench covers the everyday ones (CyberChef decode, From Base64, From Hex, URL Decode, Gunzip, To Binary, From Base, Remove null bytes) behind one Auto-detect button. It loads instantly and runs entirely in the tab.

Where CyberChef asks you to build a recipe, the decoder here infers it: it recognises the encoding, decodes, then checks whether the result is itself encoded and repeats. For a one-off CyberChef decoder job, such as unwrapping a PowerShell obfuscation chain or a gzip-in-Base64 blob, that is usually faster. For complex recipes such as XOR brute force, entropy graphs or a CyberChef hash, keep using CyberChef offline.

• Remove null bytes: the CyberChef “Remove null” step. Use it when text exported as UTF-16 (Windows Event Log XML, registry dumps) shows a gap or dot between every character.
• Embedded payloads: when a whole line is plain text, auto-detect still finds and decodes Base64, hex and URL-encoded fragments inside it.
• Gzip PowerShell: loaders often wrap a script in IO.Compression.GzipStream; the Base64 then starts with H4sI and is gunzipped automatically.

The Text ⇄ Binary tab converts text to binary and back over UTF-8 bytes, eight bits per byte (A is 01000001). Pasting binary in text form works with spaces, commas or no separators at all, and the byte count shows immediately whether the bit string is complete.

The Dec ⇄ Hex ⇄ Bin tab is a binary calculator and dec to hex converter in one: type in any of decimal, hexadecimal, binary or octal and the other three update. Values use BigInt, so 64-bit Windows status codes, timestamps and memory addresses stay exact. A 32-bit value is also shown as an IPv4 address (3232235777 is 192.168.1.1), which helps when malware stores IPs as integers.

The ASCII table tab is an ASCII calculator: type characters to see their decimal, hex and binary codes, or filter the 0–127 table by code, hex value or control-character name such as ESC or NUL.

The sample picker loads realistic inputs that show each decoding path. Windows Event Log 4625 (failed logon) is exported as UTF-16 with null bytes between characters, and Remove null bytes makes it readable. The Nginx access log contains a URL-encoded SQL injection that decodes in one step, much like a minimal nginx log parser. The syslog RFC 5424 line carries a Base64 command in its structured data, which the embedded-payload scanner decodes without touching the rest of the line.