Case study

tiktok-xgnarly-decoded: reconstructing TikTok's X-Gnarly signature format

tiktok-xgnarly-decoded reconstructs the X-Gnarly request parameter used by TikTok's web client and implements its 5.1.3-ZTCA form in JavaScript. Its format account covers a 16-field TLV payload, custom base64 alphabet, embedded random key and ChaCha-style cipher. Tests include synthetic round trips and field checks against a captured parameter.

Targets: Website
Category: Independent reconstruction cases
Relationship: Independent reconstruction project
Sources reviewed: 2026-11-07

Stars: 30
Last commit: 2026-04-27
Language: JavaScript
License (GitHub): MIT

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

Prerequisites: Node.js 18 or later.
Scope: The reference encoder and decoder target payload version 5.1.3-ZTCA; only X-Gnarly is implemented.
License: MIT.

Cite

BibTeX

@misc{tiktok-xgnarly-decoded-case,
  title = {{tiktok-xgnarly-decoded: reconstructing TikTok's X-Gnarly signature format}},
  howpublished = {\url{https://github.com/carcabot/tiktok-xgnarly-decoded}},
  url = {https://github.com/carcabot/tiktok-xgnarly-decoded},
  urldate = {2026-11-07},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/tiktok-xgnarly-decoded-case/}}
}

Plain text

tiktok-xgnarly-decoded: reconstructing TikTok's X-Gnarly signature format. https://github.com/carcabot/tiktok-xgnarly-decoded (accessed 2026-11-07). Awesome REA entry: https://awesomerea.org/resources/tiktok-xgnarly-decoded-case/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · carcabot/tiktok-xgnarly-decoded · Revision 95dd1ac
package.json GitHub · carcabot/tiktok-xgnarly-decoded · Revision 95dd1ac