CyberChef

What is CyberChef?

CyberChef is an open source web application created by the UK's GCHQ and known as "the Cyber Swiss Army Knife". It lets you encode, decode, encrypt, decrypt, compress, analyze and transform data by chaining operations into a recipe, all by drag and drop and without writing code. It has hundreds of operations: Base64, hex, XOR, AES, hashes, gzip, regular expressions, X.509 certificate parsing, JWT, timestamps and much more.

One important detail: all processing happens in your browser. The data you paste is not sent to any server, and you can download CyberChef as a single HTML file to use offline.

What CyberChef is used for

• Malware analysis and SOC work: deobfuscating encoded PowerShell commands, Base64 scripts or XORed payloads.
• Forensics: converting timestamps, extracting IPs, URLs or emails from a text dump, computing hashes.
• CTFs: basic crypto challenges and chained encodings are solved in seconds.
• Web pentesting: decoding cookies, JWT tokens or URL-encoded parameters during an audit.
• Threat intel: defanging URLs and IPs (hxxp://example[.]com) before sharing them in a report.

Getting started with CyberChef

You have three options:

1. Online: open the official GCHQ version linked from the GitHub repository.
2. Offline: download the latest release ZIP from GitHub and open the HTML file in your browser. Recommended for isolated environments or sensitive data.
3. Docker, to serve it on your internal network:

docker run -it -p 8080:80 ghcr.io/gchq/cyberchef:latest

Then open http://localhost:8080.

The interface has four areas: the Operations list (left), the Recipe (center), Input (top right) and Output (bottom right). Drag operations into the recipe and the result updates instantly.

Practical CyberChef examples

1. Decode Base64

Paste this into Input and add the From Base64 operation:

SGFja2VycyBlbiBBY2Npw7Nu

You will get Hackers en Acción.

2. Deobfuscate encoded PowerShell

Malware often runs commands like powershell -enc <base64>. That Base64 is UTF-16LE, so the recipe is:

1. From Base64
2. Decode text with encoding UTF-16LE (1200)

Many analysts use Remove null bytes instead of step 2.

3. Multi-layer payload

A typical malware recipe: From Base64 → Gunzip → XOR (with the key you find in the code) → Extract URLs. This pulls the command-and-control servers out of an obfuscated script.

4. Let CyberChef guess: Magic

If you don't know which encoding you are looking at, add the Magic operation and enable Intensive mode. It will try combinations and suggest recipes that produce readable text. The UI also shows a magic wand icon next to Output when it detects something.

When working with third-party data (tokens, cookies, captures), do so only within authorized engagements.

Pro tips

• Save your recipes: the URL includes the recipe and the input, so you can share a link with your team or store it with Save recipe.
• Use recipe breakpoints (the pause icon on each operation) to see the intermediate result of each step.
• Toggle Disable on an operation to test the recipe without it instead of deleting it.
• With confidential data, use the offline version or your own Docker instance.
• The Fork and Merge operations let you apply a recipe line by line to a list of values.

CyberChef pros and cons

Pros	Cons
Free and open source	Very large files can freeze the browser
Processes everything locally, no data sent	Doesn't replace a script for highly repetitive tasks
Hundreds of chainable operations	The number of operations is overwhelming at first
Recipes shareable via URL	Some advanced operations require solid theory

CyberChef alternatives

• CryptoHack: to learn the cryptography behind many of the operations.
• NetworkMiner: to extract from network captures the data you then decode.
• Ghidra: when you need to find the key or algorithm inside a binary.
• Command line: base64 -d, xxd or openssl to automate what you test in CyberChef.

Frequently asked questions

Is CyberChef free?

Yes, CyberChef is completely free and open source (Apache 2.0 license).

Is it safe to paste data into CyberChef?

Processing happens in your browser and nothing is sent to the server. Still, the URL may contain the input, so be careful when sharing links. For maximum privacy use the offline version.

Is CyberChef legal?

Yes. It is a data analysis tool published by a government agency and used by companies, universities and SOCs worldwide.

How do I use CyberChef to decode Base64?

Paste the text into Input, drag the From Base64 operation into the recipe and read the result in Output. If there are more layers, keep adding operations or try Magic.

To practice decoding and cryptography with guided challenges, visit the Hackers en Acción Academy.