hex

Overview

Hexadecimal (hex) is a base-16 number system, and it is the most common way to write raw bytes in a human-readable form. Where we normally count in base 10 (ten digits, 0–9), hex uses sixteen digits: 0–9 and then a–f for the values 10–15. Because one byte holds exactly two hex digits, hex is the natural "shorthand" for binary data.

In CTFs and security work you will see hex constantly: in hex dumps of files, in memory addresses, in color codes, in URL and character encodings, and as a way to represent hidden flags. Like Base64, hex is a representation, not encryption — it is fully reversible with no key.

Learning objectives

• Explain what hexadecimal is and why base 16 fits bytes so well.
• Convert between hex, decimal, and binary for small values.
• Read a hex dump and map hex bytes back to ASCII text.
• Recognize hex in the wild and understand it provides no secrecy.

Core concept

A single byte is 8 bits and can hold 256 different values (0–255). Written in binary that is up to eight characters (11111111), which is awkward to read. Hex is convenient because 4 bits map to exactly one hex digit (4 bits = 16 possible values = one hex digit), so:

• 8 bits (one byte) = two hex digits.
• Byte range 0–255 = hex range 00–ff.

This clean 2-digits-per-byte relationship is why hex, not decimal, is used to display raw data. The digit values are:

0 1 2 3 4 5 6 7 8 9 a b c d e f = decimal 0 through 15.

Hex is often written with a 0x prefix (0x41), a trailing h, or simply as pairs of digits in a dump.

How it works

To convert a two-digit hex byte to decimal, multiply the first digit by 16 and add the second:

• 0x41 = (4 × 16) + 1 = 64 + 1 = 65.
• 0xff = (15 × 16) + 15 = 240 + 15 = 255.

To go from decimal to hex, divide by 16: the quotient is the first digit, the remainder is the second.

• 65 ÷ 16 = 4 remainder 1 → 41.

To read text from hex, convert each byte to its number, then look up the ASCII character for that number. (ASCII and character sets are covered in the next lessons.)

Practical example

Take the ASCII string flag:

• f = 102 = 0x66
• l = 108 = 0x6c
• a = 97 = 0x61
• g = 103 = 0x67

So flag in hex is 666c6167. Reversing it, if a challenge gives you 666c6167, you split it into byte pairs 66 6c 61 67, convert to 102, 108, 97, 103, and read f l a g.

A single character example: A = decimal 65 = 0x41. You can verify these with common tools:

echo -n 'flag' | xxd -p        # 666c6167
echo -n '666c6167' | xxd -r -p # flag
printf '%d\n' 0x41             # 65

A hex dump (from xxd or a hex editor) shows an offset, the raw bytes in hex, and an ASCII column side by side — the standard way to inspect a file's true contents byte by byte.

Cybersecurity relevance

• Forensics and reverse engineering rely on hex dumps to inspect file headers (magic bytes), find embedded data, and identify file types regardless of extension.
• Flags are often hidden as hex, or a flag's bytes are stored in a data structure you must read in hex.
• Many other encodings build on hex: URL percent-encoding (%41), HTML numeric entities (A), and \x41-style escapes all express bytes as hex.
• Memory addresses, hashes, and cryptographic keys are conventionally shown in hex. Recognizing a hex string (only 0-9a-f, even length) tells you what you are looking at.
• As with Base64, hex is trivially reversible, so it never hides a secret — it only changes the representation.

Common mistakes

• Treating hex as encryption. It is a display format; decoding needs no key.
• Odd-length hex strings — valid byte data has an even number of hex digits; an odd count usually means truncation or a non-byte value.
• Mixing up case or the 0x prefix when feeding hex to a tool that expects raw pairs.
• Confusing the hex value with its ASCII digits — 0x41 is the byte for A, not the characters 4 and 1.

Key takeaways

• Hexadecimal is base 16 (0–9, a–f); every byte is exactly two hex digits (00–ff).
• Convert a hex byte to decimal with (first digit × 16) + second digit; 0x41 = 65 = A.
• flag in hex is 666c6167, verifiable byte by byte.
• Hex is a reversible representation, not encryption; recognizing it (only 0-9a-f, even length) is a core analysis skill.

Check your understanding

• Why does one byte always map to exactly two hex digits?
• Convert 0x41 to decimal and name the ASCII character it represents.
• If a hex string has an odd number of digits, what does that suggest?