Lion Cipher Lab
Encoding is not encryption: decode Base64, hex, and URL encoding
- Foundations
- Beginner
- ~25 min
- Free · no account required
Why it matters
Encoded data is everywhere a security professional looks: Base64 shows up in email attachments, JSON Web Tokens, cookies, HTTP headers, data: URLs, and malware config blobs; hex fills hexdumps, hashes, and packet captures; URL percent-encoding wraps every space and special character in a web request. Analysts decode this stuff constantly to read what a token, a payload, or a piece of malware is actually saying. The single most important lesson is the one beginners get wrong: encoding looks scrambled but keeps no secret — anyone can reverse it without a key. Confusing it with encryption leads…
What you'll learn
- Base64 encode/decode
- reading hexadecimal
- URL percent-encoding
- recognizing encoded data
- encoding vs encryption
Steps in this lab
- What encoding is — and the trap word next to it
- Encode and decode Base64 with your own data (three ways)
- Prove it keeps no secret — decode a blob you didn't create
- Read hex — the other encoding you'll see constantly
- URL encoding — the %20 you've seen in every address bar
- The rule this whole lab was for — never encode to protect