Skip to main content
Tool Factory

Encoding & Number Bases

Hex Content Encoder

Represent selected bytes as pipe-delimited hex groups within text. Choose special characters or all bytes for a content-string fragment.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

You can run the tool again after any change.

Options

Your result appears here

Represent selected bytes as pipe-delimited hex groups within text. Choose special characters or all bytes for a content-string fragment.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

Hex Content Encoder replaces selected bytes with hexadecimal groups enclosed in pipe characters. This mixed representation appears in Snort content strings. With Only special chars selected, foo=bar becomes foo|3d|bar.

The result combines unchanged text with pipe-delimited hexadecimal groups. The Convert option controls which bytes become hex.

  • Inspect a small mixed ASCII and hexadecimal content example.
  • Compare literal text with its pipe-delimited byte representation.
  • Prepare a content-string fragment for review in a separate rule-writing workflow.

Sources: Snort 3 Rule Writing Guide: content strings

Instructions

  1. Enter the text you want to represent as mixed content.
  2. Choose Convert: Only special chars, Only special chars including spaces, or All chars.
  3. Choose whether to print spaces between bytes, then review the generated groups.

Example

Input: a=1; b=2

Settings: Convert Only special chars, Print spaces between bytes off

Result: a|3d|1|3b| b|3d|2

Convert Only special chars including spaces also encodes the space. It returns a|3d|1|3b20|b|3d|2.

Limits

  • This tool handles content-string fragments. It does not parse or validate complete Snort rules.
  • Plain hex without pipe delimiters remains literal text in Hex Content Decoder. Use the separate Hex Decoder for that format.
  • The decoder uses permissive matching. Unmatched text can pass through unchanged; a completed result does not certify valid rule syntax.
  • A byte sequence does not identify its character encoding. Decimal byte output is not a Unicode code-point list.

Questions

How do I encode Snort content with mixed text and hex?

Enter the input and choose which characters to convert. The output encloses converted byte groups in vertical bars. For example, the default treatment turns foo=bar into foo|3d|bar.

How do I include spaces in hexadecimal groups?

Choose Only special chars including spaces to encode input spaces. Print spaces between bytes controls formatting inside hexadecimal groups. These settings serve different purposes: one selects bytes, while the other separates their written values.

Can I paste the output as a complete Snort rule?

No. The output represents content bytes rather than a complete detection rule. You still need the surrounding rule structure and valid options. Check the complete rule against the intended traffic and rule engine.