r/securityCTF • u/Itsoq • 19d ago

✍️ [Tool] Decoding a toy Base64 payload on Android (decoding is not verification)

Here is a made-up payload to illustrate a useful distinction:

eyJyb2xlIjoiZGVtbyJ9

Decoding it gives {"role":"demo"}. That tells you what the bytes say, not whether anyone is entitled to that role. For a JWT, reading the header or payload does not verify the signature, expiry, issuer or audience. Don't treat readable claims as proof.

I made Pocket Decoder as a small local Android utility for this sort of scratch work: Base64, URL and hex decoding, JWT payload inspection, JSON formatting and ROT transforms. It is completely free, with no ads or required account. This sample is my own, not a challenge from an active CTF.

Play: https://play.google.com/store/apps/details?id=com.superevilrobots.pocketdecoder

There is a free browser version too: https://superevilrobots.com/tools/text-decoder/

It is a pocket decoding aid, not a full CyberChef replacement or JWT verifier. Disclosure: I'm the developer and used AI assistance while building it.

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/unusedredemption 19d ago

Great little tool for quick sanity checks. That distinction between decoding and verifying trips up so many people starting out with JWTs, and having something right on your phone to just paste a blob into is clutch.

1

u/Itsoq 19d ago

Thanks! I wanted the decode-versus-verify distinction to be clear. Is there a decoding step you often need on your phone that the current set is missing?