Decode and encode plain text, obfuscated PowerShell -enc commands, email MIME attachments, and malware strings instantly with live client-side processing.
In malware analysis and SOC incident triage, analysts encounter Base64 encoded strings on a daily basis. From initial phishing lures delivering malicious macros to living-off-the-land binaries (LOLBins) like powershell.exe and certutil.exe, threat actors leverage Base64 to bypass traditional signature scanners.
It is essential to clarify: Base64 is an encoding scheme, not encryption. It provides no mathematical confidentiality or secrecy. However, because signature detection engines historically scanned for static strings like DownloadString, VirtualAlloc, or cmd.exe, encoding those strings into Base64 (e.g. V2luZG93cw==) successfully evades naive inspection rules.
-EncodedCommand Arguments
Windows PowerShell features a native command-line switch: -EncodedCommand (or shorthand -e, -enc). A crucial quirk that trips up novice investigators is that PowerShell expects Base64 payloads to be encoded in Unicode (UTF-16LE - Little Endian), where every ASCII character is padded with a null byte (\x00).
For example, encoding whoami in standard ASCII Base64 results in d2hvYW1p, whereas PowerShell UTF-16LE Base64 produces dwBoAG8AYQBtAGkA. Our tool automatically detects and properly normalizes UTF-16LE strings so you can inspect commands without null-byte corruption.
Base64 maps binary data into a set of 64 printable US-ASCII characters: A-Z (indices 0-25), a-z (indices 26-51), 0-9 (indices 52-61), + (index 62), and / (index 63).
=): If the total number of input bytes is not divisible by 3, one or two trailing = characters are appended to satisfy the 4-character block alignment.data:image/png;base64,iVBORw0KGgo...), and to serialize binary attachments in MIME email messages.
%2B instead of +) were not sanitized before decoding.