CyberChef — The Cyber Swiss Army Knife for Data Operations

Introduction

CyberChef is a simple, intuitive web app developed by GCHQ for carrying out all manner of cyber operations within a web browser. It lets analysts encode, decode, compress, parse, and transform data without writing custom scripts, using a drag-and-drop recipe model.

What CyberChef Does

• Provides 300+ data transformation operations in a single interface
• Chains multiple operations into reusable recipes via drag-and-drop
• Processes data entirely client-side with no server round-trips
• Supports common encodings (Base64, hex, URL), hashing (MD5, SHA), and encryption (AES, DES, RSA)
• Handles format conversions including JSON, XML, timestamps, IP addresses, and regular expressions

Architecture Overview

CyberChef runs entirely in the browser as a single-page JavaScript application. Each operation is a self-contained module that takes an input buffer and returns an output buffer. The recipe engine chains operations sequentially, passing output from one step as input to the next. Heavy operations use Web Workers to avoid blocking the UI thread.

Self-Hosting & Configuration

• Deploy with Docker: docker run -d -p 8000:80 ghcr.io/gchq/cyberchef:latest
• Alternatively, download a release ZIP and serve the static files from any web server
• No backend or database is required since all processing happens in the browser
• Place behind a reverse proxy like Nginx or Caddy for HTTPS termination
• Restrict access via your proxy or VPN since CyberChef has no built-in authentication

Key Features

• Drag-and-drop recipe builder with real-time output preview
• Supports file input and output for binary data processing
• Magic operation that auto-detects encoding and suggests decoding steps
• Shareable recipe URLs that encode the full operation chain in the hash fragment
• Works offline once loaded since it is a pure client-side application

Comparison with Similar Tools

• dCode.fr — online-only with ads; CyberChef is self-hostable and ad-free
• Custom Python scripts — flexible but require per-task coding; CyberChef offers instant visual chaining
• Hurl/httpie — focused on HTTP; CyberChef covers encoding, crypto, compression, and parsing
• DevToys — desktop-only; CyberChef works in any browser and is fully portable

FAQ

Q: Does CyberChef send my data to any server? A: No. All processing happens in your browser. Nothing leaves the page unless you explicitly export it.

Q: Can I use CyberChef offline? A: Yes. Once the page loads, it works without a network connection since it is a static client-side app.

Q: How do I share a recipe with a colleague? A: Click the save icon to generate a URL that encodes your recipe and input in the hash fragment. Anyone with the link can reproduce the operation chain.

Q: Is CyberChef suitable for processing large files? A: It handles files up to a few hundred MB in modern browsers, though very large files may be slow due to in-browser memory limits.

Sources

• https://github.com/gchq/CyberChef
• https://gchq.github.io/CyberChef/