What Is CyberChef?
CyberChef is an open-source, browser-based tool created by GCHQ (the UK's intelligence and cyber agency). It is often called "The Cyber Swiss Army Knife" because it provides hundreds of operations for data manipulation — all running entirely in your browser without any server-side processing.
Whether you are a security researcher, penetration tester, CTF player, developer, or system administrator, CyberChef handles tasks that would otherwise require multiple separate tools or complex scripts.
How CyberChef Works — Recipes
CyberChef uses a recipe metaphor:
- You provide your input (text, file, hex, binary…)
- You drag operations (called "ingredients") into a recipe
- The output is computed instantly as data flows through each step
For example, a recipe to decode a typical obfuscated payload might be: Base64 Decode → Gunzip → JSON Beautify.
Common Use Cases
For Developers
- Decode Base64 JWT tokens to inspect claims
- Beautify and validate JSON / XML responses from APIs
- Generate HMAC signatures for API authentication testing
- Convert between hex, binary, decimal, and character codes
- URL-encode query parameters with special characters
- Hash passwords or tokens (MD5, SHA-256) for verification
For Security / CTF Players
- Chain XOR → Base64 → Gunzip to de-obfuscate malware payloads
- Decrypt AES/DES/3DES ciphertexts with known keys
- Extract hidden data from steganographic images
- Identify and decode Morse code, ROT13, Bacon cipher
- Parse and analyse network packet data
For DevOps / SysAdmins
- Compress and expand Gzip/Zlib data from logs or configs
- Convert IP address formats (IPv4 ↔ IPv6, CIDR ranges)
- Parse and extract data from CSV, JSON, XML logs
- Verify checksums (MD5, CRC32, Adler-32)
Quick-Start Recipes to Try
| Task | Recipe (operations in order) |
|---|---|
| Decode a JWT token | From Base64URL → JSON Beautify |
| Hash a password | SHA-256 (or bcrypt) |
| Decode gzipped data | From Base64 → Gunzip |
| Decode obfuscated JS | From Hex → XOR key → From Base64 |
| AES encrypt a message | AES Encrypt → To Base64 |
| Extract all URLs from text | Extract URLs |
| Format a minified JSON | JSON Beautify |
Tips for Using CyberChef
- Use Ctrl+Space in the search box to quickly find operations
- Set the output encoding (Hex, Base64, Raw Bytes) using the output format button
- Click the 🔗 Share Recipe button to get a URL that encodes your entire recipe + input
- Use the Magic operation to let CyberChef try to auto-detect encodings
- Recipes are saved in your browser — use Save to keep your favourite recipes
- File input: drag and drop any file directly into the input area