DuckIntel / Security Tools

Duck Decoder

Chain decode, extract, and transform operations on analyst data. SOC playbooks, auto-detect input, live step preview, shareable recipe links.

Duck Decoder is a SOC data pipeline tool that lets you chain decode, extract, and transform operations on analyst data. Think of it as a CyberChef alternative built specifically for security workflows. Chain operations like Base64 decode, URL decode, hex decode, IOC extraction, defang, JSON formatting, and 35+ more in sequence, with a live preview of each intermediate step.

In practice, malicious actors routinely obfuscate their payloads using multiple layers of encoding. A phishing URL might be Base64-encoded inside a URL-encoded string inside a hex-encoded blob. Manually peeling each layer is tedious and error-prone. Duck Decoder handles multi-layer decoding automatically, letting you chain decode operations with a single click and immediately see the result at each step.

The tool supports shareable recipe links — you can build a decode pipeline and share the URL with a teammate who gets the exact same pipeline pre-loaded. Recipes are saved to localStorage so your common workflows persist between sessions. The auto-detect feature identifies the most likely encoding of pasted input and suggests the appropriate first operation.

Features

40+ decode, extract, and transform operations
Multi-layer decode chaining with step previews
Auto-detect input encoding
Shareable recipe URLs
IOC extraction and defang operations
JSON formatting and parsing
Base64, URL, hex, HTML entity, ROT13, Unicode decode

Part of DuckIntel.io — 59 free browser-based security tools for SOC analysts. No login. No tracking. 100% client-side.