Extract strings
Pull runs of printable text out of any binary file: the classic first look at an unknown file.
Runs on your device. The file is never uploaded.
Extract strings pulls runs of printable ASCII, 0x20 to 0x7e, out of a binary and prints them one per line. minLength defaults to 4, and the utf16le setting reads two bytes at a time, accepting a run only when every high byte is zero. No offsets are recorded, so where each run sat is a question for Hexdump.
Questions
What counts as a string?
A run of printable ASCII bytes, 0x20 to 0x7e, at least minLength characters long. minLength defaults to 4. Any byte outside that range ends the run. So tabs, newlines and every non-ASCII byte are separators, not content. The output lists the runs one per line after a header giving the count, the minimum length and the encoding used.
What does the utf16le encoding option do?
It looks for wide characters instead. In utf16le mode the file is read two bytes at a time and a character counts only when the low byte is printable ASCII and the high byte is zero, which is how English text is stored in Windows binaries and registry data. Run ascii first, then utf16le, since a string stored one way is invisible to the other pass.
Why did I get nothing back?
Because no run met the threshold, and the tool reports that there were no printable runs of that length in that encoding. Try minLength 3 or 2, and try the other encoding. Compressed or encrypted regions genuinely have almost no long printable runs; that absence is a real result, and Entropy analysis will tell you whether it is what you are looking at.
Does it show me where each string was found?
No. The output is the text of each run in the order it appeared, with no offsets. To locate one, search for it in the ASCII column of Hexdump or Hex viewer, which both print the offset at the start of every line.
Why was minLength rejected?
It must be a whole number of 1 or more, and the refusal reads "minLength must be a whole number of 1 or more". Zero is not allowed, because a run of zero characters exists at every gap in the file and the output would be meaningless. Values of 1 or 2 are accepted and will bury you in fragments, so raise the threshold rather than lowering it when a binary produces too much.
What do I do with the strings I found?
Feed them to the tools that recognise what they are. Extract IOCs pulls out domains, IPs, hashes and URLs from text. If the runs look like base64 or hex rather than words, decode them and look again. A string proves the bytes are in the file; it does not prove the program ever uses them, since dead code and stale build artefacts leave strings behind too.