Free CTF Forensics Lab
Every browser-based forensics tool you need for CTF competitions — file identification, steganalysis, cipher solving, and PCAP analysis. No install required. Files are processed locally — never uploaded.
Last updated: October 2026 · 12 tools live · 26 in development
Available Now
12 tools live today — use them in your next CTF
File Type / Magic Byte Detector
Identify any file's true format from magic bytes — not the extension. Detects mismatches, polyglots, and corrupted headers.
Strings Extractor
Extract printable strings from binary files in your browser. ASCII + UTF-16LE, byte offsets, regex filtering, and CTF flag-pattern detection.
Hex Viewer / Editor
Browse, search, and edit raw bytes of any file up to 100 MB — with magic-byte detection, pattern highlighting, and direct download of your modified file.
PNG Chunk / Integrity Analyzer
Parse every chunk in a PNG file — IHDR, IDAT, tEXt, zTXt, ancillary — verify CRC integrity, and expose hidden chunks that common viewers skip entirely.
EXIF Viewer — Extract Image Metadata Online
Read EXIF, GPS, timestamps, UserComment, MakerNote and XMP from JPEG, TIFF, PNG, WebP and HEIC images — entirely in your browser, with flag and hash detection.
Bit Plane Viewer
Slice an image into its bit planes: a channel × bit overview grid, composites, a reconstruct slider and a payload-extent strip. Exact PNG, BMP and GIF decoding.
RGB Channel Splitter
Split, inspect, swap and recombine RGB image channels in one browser-based tool: labelled Red, Green, Blue and Alpha tiles, invert, Combine from separate images, CMYK/HSV/HSL views and a two-image difference. Exact PNG and BMP decoding.
Encoding Auto-Decoder
Auto-detect and decode Base64, hex, URL, ROT13, gzip and 15+ more formats — peels nested layers, explains why it chose each format, finds encoded blobs in pasted text, and flags CTF flags at every layer.
ROT13 & Caesar Cipher Solver, Encoder and Decoder
Decode, encode and solve ROT13, ROT47 and Caesar ciphers: tries every shift, ranks the likely plaintext with an honest confidence, finds the shift from a rotated flag prefix (synt{ → flag{), and decodes only the part you choose. Encode too.
Number Base Converter — Binary, Hex, Decimal & Bytes
Convert numbers, bytes and CTF integers with arbitrary precision, two's complement and endianness controls, plus fractions and bit fields.
XOR Brute Force Tool
Brute-force single-byte XOR, break repeating-key XOR and recover keys from known plaintext. Ranked results with flag detection, all processed in your browser.
Hash Identifier
Identify possible MD5, SHA-1, SHA-256, SHA3-256, SHA-512 and CRC32 formats. Check supported hashes against a custom wordlist directly in your browser.
CTF Triage Pipeline
The standard workflow for any unknown challenge file — follow these steps in order:
Identify the file
Never trust the extension. Drop the file into the Magic Byte Detector to learn its true format from the raw header bytes.
File Type DetectorExtract strings
Run the Strings Analyzer to pull every printable sequence ≥ 4 characters. Flags, URLs, and encoding hints often appear here.
Strings AnalyzerCheck metadata
For images, audio, and PDFs, inspect all EXIF/XMP/IPTC fields. CTF authors routinely hide flags in camera make/model, GPS, or custom tags.
EXIF ViewerDecode what you found
Found a Base64, hex, URL-encoded or ROT13 string? The Encoding Auto-Decoder detects the format and peels nested layers. Then dig deeper with bit-plane filters, spectrograms, or PCAP stream reconstruction.
Encoding Auto-DecoderWhere to Start
Pick the right tool for your experience level:
No prior CTF experience needed
Familiar with common CTF formats
For CTF veterans and forensics pros
- StegSolve Online
- Stegseek / Stegcracker
- PCAP Viewer / Parser
- Embedded File Scanner (Polyglot Analyzer)
- Audio Spectrogram Analyzer
- Multi-layer Auto-Decoder
Tool Roadmap
26 tools in development across 6 categories — updated as each cluster ships.
File & Forensics Analysis
Identify any file's true format, inspect raw bytes, extract metadata, and scan for embedded payloads — the essential first-pass toolkit for every CTF challenge file.
Image Steganography
Bit-plane filters, channel splitters, entropy heatmaps, and CLI-equivalent extractors for every common CTF image steganography technique.
Audio Forensics
Spectrogram analysis and SSTV decoding — the two most common audio forensics steps in CTF competitions.
Encoding & Cipher Decoders
Auto-decode Base64/Hex/URL chains, solve classical ciphers, crack hashes, and decode JWTs — all without leaving the browser.
Network / PCAP Forensics
Parse PCAP captures, reconstruct TCP streams, extract HTTP objects, and pull auth hashes — a browser-based Wireshark alternative for CTF network challenges.
Challenge Generators
Build Steghide, LSB, and PCAP challenges ready to distribute at your next CTF — with auto-generated hints, solve scripts, and configurable difficulty.
Prefer the terminal?
These browser tools replicate the most-used CTF forensics commands — use them on a restricted machine or when you want results without spinning up a VM.
| CLI command | Browser equivalent | Status |
|---|---|---|
| file <challenge> | File Type / Magic Byte Detector | Live |
| strings <challenge> | Strings Analyzer | Live |
| xxd <file> | head | Hex Viewer / Editor | Live |
| exiftool <image> | EXIF Viewer | Live |
| binwalk <file> | Polyglot File Analyzer (binwalk-compatible) | Live |
| stegsolve.jar | StegSolve Online | Live |
| zsteg image.png | zsteg — LSB Detector | Live |
| steghide extract -sf | Steghide Extractor | Live |
| tshark -r capture.pcap | PCAP Viewer / Parser | Coming soon |
| base64 -d · xxd -r -p | Encoding Auto-Decoder | Live |
Magic Bytes Quick Reference
What are magic bytes?
Every file format defines a fixed sequence of bytes that must appear at the start (or a specific offset) of any valid file in that format. These are called magic bytes or file signatures. When you rename a file or strip its extension, the magic bytes still reveal the true format — making them the most reliable identification method in CTF forensics. Tools like file on Linux and the File Type Detector here use exactly this technique. The Strings Analyzer can also surface ASCII-readable magic bytes inside binary files.
| Format | Hex signature | Note |
|---|---|---|
| PNG | 89 50 4E 47 0D 0A 1A 0A | Always identical — most reliable |
| JPG | FF D8 FF | First 3 bytes; FF D9 at EOF |
| GIF | 47 49 46 38 | GIF87a or GIF89a |
| ZIP | 50 4B 03 04 | Also .docx, .xlsx, .apk, .jar |
| 25 50 44 46 2D | %PDF- (version follows) | |
| ELF | 7F 45 4C 46 | Linux executables & shared libs |
| MP3 | 49 44 33 | ID3 tag header; or FF FB for raw |
| WAV | 52 49 46 46 ... 57 41 56 45 | RIFF....WAVE (bytes 0-3 + 8-11) |
| WebP | 52 49 46 46 ... 57 45 42 50 | RIFF....WEBP (bytes 0-3 + 8-11) |
| GZIP | 1F 8B | Also .tar.gz, .tgz payloads |
| RAR | 52 61 72 21 1A 07 | Rar! magic (v4); 00 for RAR5 |
| 7z | 37 7A BC AF 27 1C | 7z archive — check if nested zip |
| BMP | 42 4D | BM — common CTF palette stego target |
| FLAC | 66 4C 61 43 | fLaC — check for LSB audio stego |
| MP4 | xx xx xx xx 66 74 79 70 | ftyp at offset 4 (box type field) |
| SQLite | 53 51 4C 69 74 65 20 66 | SQLite format 3 — first 8 bytes |
| PE/EXE | 4D 5A | MZ — Windows PE; PE header at 0x3c offset |
| TAR | 75 73 74 61 72 | ustar at byte offset 257 (not offset 0) |
Frequently Asked Questions
Do I need to install anything?
No. Every CTF Lab tool runs 100% in your browser via JavaScript and WebAssembly. No extensions, no Python, no Docker — just open the page and start.
Are my files uploaded to a server?
No. Files are processed locally in your browser using the FileReader API and Web Workers. They are never uploaded to our servers.
What's the difference between CTF Mode and Basic mode on the file detector?
CTF Mode shows CLI commands (file, xxd, binwalk, strings) alongside the browser result so you can pivot to terminal tools instantly. Basic mode shows a clean visual-only report.
Which tools are live right now?
File Type / Magic Byte Detector, Strings Extractor, Hex Viewer / Editor, PNG Chunk / Integrity Analyzer, EXIF Viewer — Extract Image Metadata Online, Bit Plane Viewer, RGB Channel Splitter, Encoding Auto-Decoder, ROT13 & Caesar Cipher Solver, Encoder and Decoder, Number Base Converter — Binary, Hex, Decimal & Bytes, XOR Brute Force Tool, and Hash Identifier are live today. The remaining 26 tools are in active development — the next cluster (Image Stego) is next in the queue.
How does magic byte detection work?
The file detector reads only the first 512 bytes of your file and matches them against a database of 100+ file signatures. The filename extension is ignored — only the raw bytes matter.
Can I use these tools in a real CTF competition?
Yes — that's the entire purpose. All processing is client-side, so there are no rate limits, no accounts required, and no data retention of any kind.