Skip to main content
Tool Factory

Encoding & Number Bases

Hex Content Decoder

Decode pipe-delimited hex groups mixed with ASCII text, as used in Snort content strings. Review decimal byte values.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

You can run the tool again after any change.

Your result appears here

Decode pipe-delimited hex groups mixed with ASCII text, as used in Snort content strings. Review decimal byte values.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

Hex Content Decoder reads hexadecimal groups between pipe characters within ordinary ASCII text. This mixed representation appears in Snort content strings. For example, foo|3d|bar represents foo=bar. The current result displays decimal byte values.

The result is an array of decimal byte values. The example foo|3d|bar produces [102,111,111,61,98,97,114]. These bytes represent the ASCII text foo=bar.

  • Inspect a small mixed ASCII and hexadecimal content example.
  • Compare literal text with its pipe-delimited byte representation.
  • Prepare a content-string fragment for review in a separate rule-writing workflow.

Sources: Snort 3 Rule Writing Guide: content strings

Instructions

  1. Paste only the content string, such as foo|3d|bar. Do not paste a complete Snort rule.
  2. Use two hexadecimal digits per byte inside each pipe-delimited group. Spaces can separate the byte pairs.
  3. Review the decimal byte array. Use Hex Decoder in the related tools for plain hexadecimal input without pipes.

Example

Input: a|3d|1|3b20|b|3d|2

Settings: No settings

Result: [97, 61, 49, 59, 32, 98, 61, 50], the ASCII bytes of a=1; b=2

One pair of bars can hold several bytes. Here |3b20| decodes to a semicolon and a space.

Limits

  • This tool handles content-string fragments. It does not parse or validate complete Snort rules.
  • Plain hex without pipe delimiters remains literal text in Hex Content Decoder. Use the separate Hex Decoder for that format.
  • The decoder uses permissive matching. Unmatched text can pass through unchanged; a completed result does not certify valid rule syntax.
  • A byte sequence does not identify its character encoding. Decimal byte output is not a Unicode code-point list.

Questions

How do I decode Snort-style hexadecimal content?

Use mixed ASCII text with hexadecimal bytes between vertical bars, such as foo|3d|bar. The decoder returns the corresponding byte array. For that example, the bytes represent foo=bar, although the interface can display decimal byte values.

Why does plain hexadecimal text stay as literal characters?

This format decodes hexadecimal only inside vertical-bar groups. An input such as 48656c6c6f outside bars remains literal text bytes. Use Hex Decoder when the entire input is an ordinary hexadecimal byte string.

Does Hex Content Decoder validate a complete Snort rule?

No. It processes the content representation rather than a full rule grammar. A completed result does not certify rule syntax or matching behavior. Validate the complete rule separately in its intended ruleset and engine.