EasyExtract

Uncategorized

How to Convert Hex Dumps to Plain Text and ASCII Strings

By · · 10 min read

To convert a hex dump into plain text and ASCII strings, parse the two-character hexadecimal byte pairs (0x00–0xFF), strip memory offset addresses, and decode the resulting byte sequence into UTF-8 or ASCII characters using a stream decoder. You can decode complete memory dumps instantly with our private in-browser hex to text extractor without transmitting data to external servers.

Key definitions: Hexadecimal notation, nibbles, bytes, offset addresses, and character decoders

Decoding raw memory captures, packet payloads, and compiled binaries back into intelligible text requires an understanding of low-level data structures and byte representations:

  • Hexadecimal Notation (Base-16): A positional numeral system with a radix of 16 using symbols 0–9 and A–F (or a–f). Hexadecimal notation serves as human-readable shorthand for 8-bit binary data.
  • Nibble (4 Bits): A half-byte sequence of four binary bits represented by a single hexadecimal character (e.g. binary 1111 equals hex F).
  • Byte or Octet (8 Bits): The standard unit of digital storage formed by two hexadecimal characters (e.g. hex 41 represents binary 01000001 or decimal 65, mapping to ASCII 'A'). Values range from 0x00 to 0xFF (0 to 255).
  • Offset Address: A memory pointer printed at the start of each dump line (such as 00000000:) indicating the relative byte distance from the start of the buffer.
  • ASCII Sidebar: The rightmost visual column of a canonical hex dump that displays printable characters (0x20 to 0x7E) and replaces non-printable bytes with placeholder dots (.).
  • UTF-8 Multi-byte Decoding: The standard variable-width encoding scheme that decodes one to four 8-bit bytes into Unicode code points, supporting international alphabets and emoji symbols.

Structure of a hex dump: Dissecting offsets, byte matrices, and printable text sidebars

Hexadecimal inspection tools—such as UNIX hexdump -C, xxd, and Wireshark—format binary buffers into a canonical three-column layout:

00000000: 4865 6c6c 6f20 576f 726c 6421 0d0a 4561  Hello World!..Ea
00000010: 7379 4578 7472 6163 7420 3230 3236 2100  syExtract 2026!.
Component Example Parsing Rule
1. Offset Column 00000000: Positional memory address. Must be stripped before decoding so addresses are not ingested as ASCII text.
2. Hex Byte Matrix 48 65 6c 6c 6f 20... The central payload containing the raw hexadecimal byte pairs. This represents the primary data to decode.
3. ASCII Sidebar |Hello World!..| Visual preview column. Must be excluded during automated extraction to prevent duplicate string fragments.

Step-by-step: How to decode hex dumps to plain text in your browser

Modern browsers can decode large hexadecimal streams directly using JavaScript TypedArrays and the native W3C Encoding API. Follow these five procedural steps:

  1. Step 1: Ingest the hex dump or raw stream: Paste your memory capture, Wireshark payload, or compiler output into the decoder workspace.
  2. Step 2: Strip address offsets, sidebars, and formatting delimiters: Remove line numbers, sidebar text, 0x prefixes, spaces, and line breaks using regular expressions to isolate pure hex pairs: 
    function cleanHexDump(raw) {
  return raw.split(/\r?\n/).map(line => {
    let hex = line.replace(/^[0-9a-fA-F]+[:\s]\s*/, '');
    const pipe = hex.indexOf('|');
    return pipe !== -1 ? hex.substring(0, pipe) : hex;
  }).join(' ').replace(/0x|\\x|[^0-9a-fA-F]/g, '');
}
  3. Step 3: Group hex pairs into an 8-bit byte array: Confirm the character count is even, then parse consecutive two-character pairs into an unsigned 8-bit integer array (Uint8Array): 
    function hexToBytes(hex) {
  if (hex.length % 2 !== 0) throw new Error("Invalid hex: odd number of characters.");
  const bytes = new Uint8Array(hex.length / 2);
  for (let i = 0; i < hex.length; i += 2) {
    bytes[i / 2] = parseInt(hex.substr(i, 2), 16);
  }
  return bytes;
}
  4. Step 4: Decode byte arrays into UTF-8 text: Pass the Uint8Array buffer to the native TextDecoder API with fatal: false to convert single-byte and multi-byte sequences into clean text: 
    function bytesToText(bytes) {
  return new TextDecoder('utf-8', { fatal: false }).decode(bytes);
}
  5. Step 5: Export or filter the decoded output: Copy the reconstructed text to your clipboard or download the string buffer as a plaintext document.

Extracting printable ASCII strings (≥ 4 characters) like the Linux strings utility

Raw binary files and firmware dumps contain compiled machine opcodes, memory pointers, and null padding. Decoding raw binaries directly into text yields unreadable control characters.

The POSIX strings algorithm resolves this by scanning binary byte arrays and extracting contiguous sequences of printable graphic characters (ASCII 0x20 to 0x7E) that meet or exceed a specified minimum length threshold (typically 4 characters):

function extractStrings(bytes, minLen = 4) {
  const results = [];
  let run = [];
  for (let i = 0; i < bytes.length; i++) {
    const b = bytes[i];
    if ((b >= 0x20 && b <= 0x7E) || b === 0x09 || b === 0x0A || b === 0x0D) {
      run.push(String.fromCharCode(b));
    } else {
      if (run.length >= minLen) results.push(run.join(''));
      run = [];
    }
  }
  if (run.length >= minLen) results.push(run.join(''));
  return results;
}

This technique extracts embedded URLs, file paths, debug messages, and configuration strings from unknown payloads. During forensic investigations, you can also extract cryptographic hashes from logs or decode Base64 encoded strings embedded within extracted text.

Decoding character encodings: ASCII vs UTF-8 vs UTF-16 vs Latin-1 byte patterns

Hexadecimal bytes lack intrinsic meaning; their visual output depends entirely on the character encoding applied during decoding.

Character Standard ASCII ISO-8859-1 (Latin-1) UTF-8 (1–4 Bytes) UTF-16 Little Endian
A 41 41 41 41 00
é Undefined E9 C3 A9 E9 00
£ Undefined A3 C2 A3 A3 00
€ Undefined Undefined E2 82 AC AC 20
🚀 Undefined Undefined F0 9F 9A 80 3D D8 80 DE
  • ASCII (7-bit / 0x00–0x7F): Covers English letters, numbers, and punctuation. Non-English symbols are undefined.
  • ISO-8859-1 (Latin-1): Maps 8-bit values (0–255) to Western European characters (such as é as 0xE9).
  • UTF-8: Variable-length encoding using 1 byte for ASCII, 2 bytes for Latin/Greek/Arabic, 3 bytes for Asian scripts, and 4 bytes for emoji.
  • UTF-16 (Little Endian): Encodes basic characters into 2-byte units. ASCII characters appear with interleaved null bytes (e.g. 41 00 for 'A'), producing dotted strings if read with an ASCII decoder.

Hex vs Base64 vs Binary: Data representation and overhead comparison table

Developers frequently compare hexadecimal encoding against Base64 and raw binary representations when transmitting data across HTTP and API boundaries:

Encoding Base Bits / Char Size Overhead Character Set Common Use Cases
Binary 2 1 bit +700% (8 chars/byte) 0, 1 Bitwise register and logic analysis.
Hexadecimal 16 4 bits +100% (2 chars/byte) 0–9, a–f Memory dumps, cryptographic hashes, bytecode inspection.
Base64 64 6 bits +33.3% (4 chars/3 bytes) A–Z, a–z, 0–9, +, /, = Data URIs, JWT tokens, email MIME attachments.

While hex encoding doubles the size of raw binary data, its strict 1:1 nibble alignment makes it the industry standard for memory analysis. To learn more about 6-bit data serialization, check our guide on how to decode Base64 strings in your browser.

Reverse engineering & security analysis: Extracting URLs, IP addresses, and magic byte signatures

Security analysts routinely inspect hex dumps to extract indicators of compromise (IOCs) and verify file types independently of extensions.

1. Identifying file types via magic byte signatures

Operating systems and antivirus scanners identify file types using fixed magic bytes located at offset 00000000:

File Format Magic Bytes (Hex) ASCII Signature MIME Type
Windows Executable (PE) 4D 5A MZ application/x-dosexec
Linux Executable (ELF) 7F 45 4C 46 .ELF application/x-executable
PDF Document 25 50 44 46 %PDF application/pdf
PNG Image 89 50 4E 47 0D 0A 1A 0A .PNG.... image/png
ZIP Archive / Office DOCX 50 4B 03 04 PK.. application/zip
GZIP Archive 1F 8B 08 ... application/gzip

2. Carving network indicators and C2 domains

Malware payloads often embed Command-and-Control (C2) domains in binary strings. For example, decoding the hex sequence 68 74 74 70 73 3a 2f 2f 61 70 69 2e 6d 61 6c 69 63 69 6f 75 73 2e 74 6c 64 immediately reveals the malicious endpoint https://api.malicious.tld.

Common pitfalls: Non-printable control characters, corrupted nibbles, and endianness

Manual and automated hex decoding can fail due to four common technical issues:

  • Corrupted or Odd-Length Hex Strings: Every byte requires two hex characters. An odd-length string (e.g. 48 65 6) indicates a truncated nibble, shifting byte boundaries and corrupting subsequent text.
  • Control Characters and Null Bytes (0x00): Binary control characters (0x00–0x1F, 0x7F) can truncate strings in C-style runtimes or cause terminal rendering errors.
  • Endianness Mismatches (Little vs Big Endian): Big Endian systems store significant bytes first (12 34 56 78), whereas Little Endian architectures (x86/ARM) store least significant bytes first (78 56 34 12). Reading multi-byte UTF-16 data without accounting for Little Endian byte order causes garbled output.
  • Byte Order Mark (BOM) Artefacts: Unhandled UTF-8 BOM headers (EF BB BF) appear as  in legacy Latin-1 decoders.

Privacy & security: Why raw memory captures and decrypted payloads must remain 100% in-browser

Forensic memory dumps and network packet captures often contain highly confidential information, such as decrypted passwords, private encryption keys, session tokens, and personal identifiable information (PII).

Uploading raw hex dumps to server-side converter websites introduces significant data breach risks. Remote servers may log payloads, retain memory captures on disk, or expose sensitive tokens to third parties.

EasyExtract executes all conversions entirely within your local browser using client-side JavaScript. Hex sanitisation, byte array allocations, and character decoding remain 100% local, ensuring complete privacy, zero data retention, and compliance with GDPR and HIPAA security standards.

Frequently asked questions

1. What is a hex dump and why is it used?

A hex dump is a hexadecimal representation of binary data, displaying byte values (00 to FF) alongside memory offset addresses and printable ASCII characters. It allows developers and security analysts to inspect raw files, network packets, and compiled machine code without corruption from non-printable control characters.

2. How do I convert a hex string with spaces or 0x prefixes into plain text?

Remove formatting prefixes and delimiters by applying a regular expression to strip 0x, \x, spaces, and line breaks. Once sanitised into continuous two-character hex pairs, parse each pair into an 8-bit integer array and decode the bytes using UTF-8 or ASCII character mappings.

3. Why does my hex dump produce dots (.) instead of readable characters?

Canonical hex dump utilities substitute non-printable control bytes (values 0x00 to 0x1F and 0x7F to 0xFF in standard ASCII) with full stops (.) in the right-hand sidebar to prevent terminal screen corruption. When converting hex directly to text, a true decoder attempts to interpret multi-byte sequences into valid UTF-8 characters rather than placing dots.

4. How do I decode UTF-8 multi-byte characters from hex?

Convert your hex pairs into an unsigned 8-bit integer array (Uint8Array) and pass the buffer into the JavaScript TextDecoder('utf-8') API. The decoder automatically handles variable-width leading and continuation bytes, correctly reconstructing accented characters, non-Latin alphabets, and emojis.

5. What is the minimum string length used when extracting ASCII strings from binaries?

The standard minimum threshold established by the POSIX strings utility is 4 consecutive printable ASCII characters (bytes ranging from 0x20 to 0x7E). This threshold filters out random binary noise and short machine opcodes while capturing meaningful words, file paths, and function identifiers.

6. How does Little Endian byte ordering affect hex string extraction?

Little Endian architectures store the least significant byte first. While single-byte ASCII strings remain in standard sequential order, 16-bit wide characters (UTF-16) will store the ASCII character byte followed by a null byte (e.g. 48 00 for 'H'), requiring a Little Endian UTF-16 decoder to avoid interleaved spaces or null characters.

7. Is it safe to paste forensic memory dumps or decrypted packets into online hex decoders?

It is only safe if the hex decoder operates 100% client-side inside your browser without transmitting data to remote servers. Server-based converters can log, cache, or expose private cryptographic keys, passwords, and sensitive memory data. EasyExtract processes all conversions locally on your machine for guaranteed security.

Explore our suite of private, browser-based extraction and conversion utilities:

Sources and references

This technical guide references official networking protocols, character set specifications, and international computing standards:

Keep reading