Forge

What is Base64 encoding?

Base64 is an encoding that represents bytes using an alphabet of 64 characters. It carries binary data in text formats. It is reversible without a key: encoding data as Base64 does not encrypt it or make it confidential.

Encoding, encryption and hashing

These three transformations meet different needs. Mixing them up leads to common audit mistakes, such as treating a Base64 token as protected.

Encoding

Encoding adapts data to a transport channel: Base64 to carry binary inside text, URL encoding for a query parameter, hexadecimal to display bytes. It is fully reversible without any secret, so anyone can decode an encoded value. A cookie or token that looks unreadable is often plain Base64.

Encryption

Encryption makes data unreadable without the key. The XOR operation here shows the principle, but a short-key XOR falls quickly to frequency analysis, or as soon as the key is reused. To protect data, use AES-GCM or ChaCha20-Poly1305 with proper key management, which is beyond the scope of an encoding tool.

Hashing

Hashing produces a fixed-size digest that cannot be reversed. To check a SHA-256, you hash a candidate again and compare. MD5 and SHA-1 are still usable as checksums, but practical collisions exist for both, so they are unsuitable for any security purpose. To store passwords, use a dedicated function such as bcrypt or Argon2, never a fast hash.

Uses in CTFs and penetration tests

Forge is mostly for repetitive handling: decoding a Base64 blob and decompressing it (From Base64 then Gunzip), reading the claims of a JWT and spotting an alg: none, peeling off several layers of URL encoding added to get past a WAF, or recovering plaintext behind an XOR with a known key. Since every step works on bytes, recipes that mix binary and text give exact results.

Operations and what runs them

• Base64, Base64url, hex, URL and HTML entities: standard browser APIs (btoa, atob, encodeURIComponent, TextEncoder).
• Gzip, Zlib and raw Deflate, both ways: the fflate library.
• MD5, SHA-1, SHA-256, SHA-512 and SHA3-256: the hash-wasm library, compiled to WebAssembly.
• JWT decoding: the jose library, without signature verification (use the JWT Inspector for that).
• JSON Beautify and Minify, ROT13 and XOR: a few lines on top of JSON and byte arrays.

Opening the recipe in CyberChef

CyberChef, published by GCHQ under the Apache 2.0 licence, offers several hundred operations. The Open in CyberChef button translates each step to the equivalent CyberChef operation and builds a link to gchq.github.io. By default the link holds only the recipe. If you tick the box for it, the input is added in Base64 and then ends up in your browser history.

Local processing

The data you process stays in your browser and no network request is made while it runs. This page’s share link holds only the list of steps, encoded in the URL fragment (the part after #), which the browser does not send to the server.