Zkitszo - The Real
August 14, 2026

Hex, Bit, Byte, Plain Text, Convert-em-all

From Raw Bytes to Plain Text: The Browser Converters Every Capture Needs

A capture is only half the job. A router firmware dump, a demodulated bitstream, a saved packet — they all land as the same thing: a wall of hexadecimal, base64, and raw binary that means nothing until it's turned back into text a human reads. A handful of free, browser-based converters finish that second half in a single tab, no install. Here's each conversion that matters and exactly where it slots into work already on this blog.

Jump to: Reading raw bytes · Base64 & URL · MAC in binary · Did it land intact? · Escaping code · Odd jobs · Glossary · Sources

A workbench with a HackRF, an RTL-SDR dongle, a Raspberry Pi, and a laptop showing a hex-to-text converter in a browser
The last link in the chain isn't RF or copper — it's a converter that turns the capture into words.

Reading raw bytes: hex, binary, ASCII

Every demodulated bitstream and carved file eventually lands as hex. A hex-to-string conversion is the fastest way to surface the printable ASCII hiding inside — paste 48 65 6C 6C 6F, read Hello. That's the by-hand version of the strings pass over a router image in the firmware-extraction work, and the quick sanity check on a chunk of a decoded frame off the RTL-SDR and cell-sniffing rigs, no script required. Hex-to-binary and hex-to-decimal handle the register math — flipping a single bit in a config byte, or turning an ADS-B hex message field into the value it actually encodes. Worth stating once: receiving and decoding is the unregulated half of this hobby; transmitting is where a license enters the picture.

Diagram: an RF capture flows through demodulation into a hex string, then a converter, then readable text
Signal → capture → hex/base64 → convert → readable. The last two steps are the browser's job.

Base64 & URL decoding

Open a packet capture in Wireshark and two encodings turn up constantly. An HTTP Authorization: Basic dXNlcjpwYXNz header is plain base64 — one base64 decode and it reads user:pass. Percent-mangled request parameters (%2F, %20) fall back to / and spaces through a URL decode. Same trick offline: embedded certificates, NVRAM blobs, and stashed configuration inside a firmware image are frequently base64, and decoding one tells you what you carved before you reach for a hex editor.

MAC addresses in binary: the one bit that matters

A MAC address is six hex octets, which makes it a natural for a hex-to-binary conversion. The two low bits of the first octet carry meaning: bit 0 is unicast versus multicast, bit 1 is the "locally administered" flag a spoofer sets. Watch it in binary — first octet 0x00 is 00000000; set the locally-administered bit and you get 00000010, i.e. 0x02, so 00:11:22:… becomes 02:11:22:…. That single bit is the whole difference between a burned-in vendor address and a made-up one.

Hashing: did it land intact?

After pulling or reflashing firmware, an MD5 / SHA-256 digest answers one question fast: does the file I have match the file I was supposed to get? Hash it, compare to the published value, done.

💎 Buried detail: MD5 is cryptographically broken — collisions are trivial to manufacture — but that doesn't retire it here. As an integrity check it's still perfect: it reliably catches a corrupted download or a bad flash. Just don't trust it to prove a file wasn't deliberately altered; reach for SHA-256 when the threat is malice, not a flaky cable.

Escaping code so the editor doesn't eat it

Anyone posting code the GitHub-Markdown way hits this wall: paste a snippet with raw <, >, or & into the Blogger editor and the platform quietly swallows the tags. An HTML-entity escape converts those to &lt;, &gt;, &amp; first, so they render as literal text instead of vanishing. Run it in reverse to unescape, and a string-to-hex conversion turns a page of Unicode or ASCII code points into the glyphs they stand for. One-click formatters and minifiers for HTML, CSS, JavaScript, JSON, and SQL round it out — enough to make a scraped one-line blob readable before you pick it apart.

💎 Buried detail: Blogger silently drops raw < and > from a code block — the text between them just disappears on publish. Escaping to entities before the paste is the fix, and it's why a code snippet that looked fine in the editor can render half-empty on the live page.

The odd-jobs drawer

The rest earn their bookmark quietly. A Unix timestamp converter turns the epoch integers littering syslog into human time — the exact friction behind the "what to log?" question. What is my IP and is it up or down are the two-second checks that come up around any network or privacy project, and a default router settings lookup coughs up the stock gateway IP and admin login for a model you're poking at. None are glamorous; all are faster than the alternative.

Glossary

Base64
An encoding that packs arbitrary bytes into 64 printable characters so binary data survives a text-only channel like an HTTP header or a config file.
Hash (MD5 / SHA)
A fixed-length fingerprint computed from a file; identical files hash identically, so a matching digest means the bytes didn't change in transit.
HTML entities
Text stand-ins like &lt; for reserved characters (< > &), so a browser or editor prints them instead of treating them as markup.
Locally administered address (LAA)
A MAC address flagged by one bit in its first octet as user-assigned rather than burned in by the manufacturer — the hallmark of a spoofed address.
Percent (URL) encoding
The %XX scheme representing reserved or non-ASCII characters in a URL, e.g. %20 for a space.
Unix timestamp (epoch)
Seconds counted since 1 January 1970 UTC — the compact integer most logs use to record when an event happened.

Sources & References

Comments

Post a Comment

← Newer