OverTheWire Bandit Level 10 Writeup — Decode a Base64-Encoded Password
data.txt holds the password encoded in base64 — the base64 command's -d flag decodes it directly back to plain text.
| Platform | OverTheWire Bandit |
| Category | Linux Fundamentals |
| Level | 10 → 11 |
| Difficulty | Beginner |
| Technique | base64 decoding |
Challenge description
No searching or filtering this time — the file is small and its entire content is the password, just run through base64 encoding first.
"Level Goal: The password for the next level is stored in the file data.txt, which contains base64 encoded data."
Step 1 — Look at the raw content
Log in as bandit10 and view the file directly — it's short, and clearly made up only of base64's alphabet (letters, digits, +, /, and padding = characters):
cat data.txtVGhlIHBhc3N3b3JkIGlzIC4uLg==Step 2 — Decode it
The base64 utility's -d (decode) flag reverses the encoding directly:
base64 -d data.txt[PASSWORD FOR bandit11]The password is deliberately hidden — follow the method, you've earned it. 💪
Key takeaways
Base64 is encoding, not encryption — it has no secret key, so anything base64-encoded decodes with a single command the moment you recognize the alphabet. Spotting base64 by sight (that specific character set, often padded with one or two trailing = signs) is a skill worth having automatic by this point.
- Base64 uses only A-Z, a-z, 0-9,
+,/, and=padding — recognizable on sight once you've seen it a few times base64 -ddecodes; plainbase64(no flag) encodes- No password or key is involved — base64 is a reversible encoding, never a cipher
Resources
- OverTheWire Bandit
- RFC 4648 — Base64 encoding
- CTFdojo guide — CyberChef for CTF Encoding and Decoding
Got a question or a different approach?
Discuss this writeup with the community on the CTFdojo Discord.
Join the Discord →