The Encoding Onion

Encoding is not encryption. It changes how data looks, and anyone can change it back, because no key is involved. Attackers and malware authors still pile encodings on top of each other to hide things from a casual look, and defenders learn to peel them off one at a time.

The Onion Peeler shows a block of text wrapped in 4 layers. Each layer is one of a small family: base64, hexadecimal, rot13 or URL encoding. Nothing tells you which is which, so you must look at the shape of the text at every step. Base64 uses letters, digits and a padding sign; hex uses only digits and the first six letters; rot13 keeps the look of text but shifts it; URL encoding is full of percent signs.

For each layer, press the peel button for the encoding you recognise, and only once you have recognised it. Continue until the readable flag is at the centre.

The lesson is worth remembering when you meet obfuscated data in the wild: recognise the encoding, decode, look again, repeat.