Binary Strings Extractor
Extract printable ASCII and UTF-16 strings from any binary, firmware or malware sample — like the Unix strings command, with a length filter. Free, no upload.
Or drop any file here to scan its raw bytes
🔒 Files and pasted bytes are scanned entirely in your browser — nothing is uploaded. Safe for inspecting untrusted malware or firmware samples offline.
What "strings" extraction is
Compiled binaries, firmware images and malware samples are mostly non-printable machine code, but they almost always carry islands of readable text: embedded URLs and C2 domains, file paths, registry keys, error messages, version banners and configuration. Extracting strings scans the raw bytes for runs of printable characters — exactly what the classic Unix strings command does — so you can read those indicators without ever executing the file. This tool finds both single-byte ASCII strings and UTF-16LE "wide" strings, which is how Windows executables store most of their text.
Fast triage, entirely in your browser
Drop any file, or paste a hex or Base64 dump, and every printable run of at least the chosen minimum length is listed instantly. Lower the minimum length to surface short tokens, or raise it to cut noise and keep only meaningful strings. Because the scan runs locally and nothing is uploaded, it is safe for untrusted malware and firmware samples — the bytes never leave your machine. Use Copy all to pull every match into your notes or a report.
Frequently asked questions
What is the Unix strings command?
strings prints sequences of printable characters found in a file, which is the quickest way to see the URLs, paths and messages embedded in a binary without running it. This tool reproduces that in the browser and adds UTF-16 (wide) string detection.
Why are there two lists, ASCII and UTF-16?
ASCII strings use one byte per character, while Windows programs commonly store text as UTF-16LE, where each character is a byte followed by 0x00. Scanning for both means you do not miss wide strings that a plain ASCII scan skips.
What does the minimum length slider do?
It sets how many printable characters in a row count as a string. A higher minimum hides short, noisy fragments; a lower minimum surfaces short tokens like flags or file extensions. Four is a common default.
Is my file uploaded anywhere?
No. The file or pasted bytes are read and scanned entirely in your browser, so nothing is sent to a server — safe for sensitive or malicious samples.