Binary Strings Extractor
Extract ASCII, UTF-8 and UTF-16 strings, with byte offsets, from a binary, firmware or malware sample, like Unix strings — nothing is uploaded.
Safe for inspecting untrusted malware or firmware samples offline.
Or drop any file here to scan its raw bytes
What "strings" extraction is
Compiled binaries, firmware images and malware samples are mostly non-printable machine code, but they almost always carry islands of readable text: embedded URLs and C2 domains, file paths, registry keys, error messages, version banners and configuration. Extracting strings scans the raw bytes for runs of printable characters — exactly what the classic Unix strings command does — so you can read those indicators without ever executing the file. This tool finds both single-byte ASCII strings and UTF-16LE "wide" strings, which is how Windows executables store most of their text — and, from the Wide strings menu, big-endian UTF-16 or both byte orders. Tick Include UTF-8 text and a run carries on through Korean, accented or other UTF-8 characters instead of breaking at the first one; Show byte offset prints where each string starts, as 0x0000001a, so you can find it again in a hex editor; Unique only and Sort A–Z tidy the list, and a count of every string found heads it.
Fast triage, entirely in your browser
Drop any file, or paste a hex or Base64 dump, and every printable run of at least the chosen minimum length is listed instantly. Lower the minimum length to surface short tokens, or raise it to cut noise and keep only meaningful strings. The number box under the slider takes a longer minimum than the slider reaches, for a dump where only long strings matter. Because the scan runs locally and nothing is uploaded, it is safe for untrusted malware and firmware samples — the bytes never leave your machine. Use Copy all to pull every match into your notes or a report. The Characters menu narrows a string to letters, digits and punctuation, and Only NUL-terminated (C strings) keeps a run only when a NUL byte ends it; Search the strings and Kind of string — URLs, email addresses, file paths, identifiers — filter what is listed, copied and saved; a switch prints the bytes either side of each string in hex, to read it in context; and Download CSV saves each string with its encoding, offset and length.
Frequently asked questions
What is the Unix strings command?
strings prints sequences of printable characters found in a file, which is the quickest way to see the URLs, paths and messages embedded in a binary without running it. This tool reproduces that in the browser and adds UTF-16 (wide) string detection.
Why are there two lists, ASCII and UTF-16?
ASCII strings use one byte per character, while Windows programs commonly store text as UTF-16LE, where each character is a byte followed by 0x00. Scanning for both means you do not miss wide strings that a plain ASCII scan skips. Choose UTF-16 big-endian, or both byte orders, in the Wide strings menu, and each order gets a list of its own.
What does the minimum length slider do?
It sets how many printable characters in a row count as a string. A higher minimum hides short, noisy fragments; a lower minimum surfaces short tokens like flags or file extensions. Four is a common default.
Can it find Korean or other non-ASCII text, and say where each string is?
Yes. Tick Include UTF-8 text (Korean, accents…) and the single-byte list becomes ASCII + UTF-8 strings: a run carries on through every well-formed printable UTF-8 character, and the minimum length counts characters rather than bytes, so Hello 안녕하세요 café comes out whole. Tick Show byte offset and each string is prefixed with the offset of its first byte, as 0x0000001a, in the list, in Copy all and in the saved file alike — so you can find it again in a hex editor.
Can I keep only C strings, search the results, or see the bytes around each one?
Yes. Characters chooses All printable characters or Letters, digits and punctuation, and Only NUL-terminated (C strings) keeps a run only when the byte that ends it is 00 — 00 00 for a wide run — so one cut off by the end of the file is left out; both apply to the ASCII, UTF-8 and wide lists alike. Search the strings (case-insensitive) and Kind of string — URLs, email addresses, file paths, identifiers such as UUIDs, hashes and versions — filter what is listed, copied and saved, and the count says how many match. A switch prints the hex before and after each string, padded so the strings stay in a column, in Copy all and the text file too, and Download CSV saves the encoding, offset, length and string of each one.
Can I set a minimum length longer than the slider goes?
Yes. Under the slider, a number box takes the minimum directly, well past the slider's end — useful on a large dump where only long strings such as keys, URLs or embedded scripts matter. The box has a ceiling of its own, and a larger number is held at it; while the minimum is past the slider's range, the slider simply rests at its end.