Categories
Self-Hosted Developer Tools Utilities Security Encryption Data Analysis Forensics EncodingStars
Forks
Watchers
Developer links
CyberChef
GCHQ open-sourced its "Cyber Swiss Army Knife", and CyberChef became the web app security analysts, incident responders, and CTF players reach for when data needs decoding, decrypting, or dissecting. Its interface is four panes: paste or drag input (files up to 2GB), search a categorized library of hundreds of operations, drag them into a recipe with arguments, and read the output. Operations span Base64, hex, and XOR encoding; AES, DES, and Blowfish encryption; classical ciphers from Caesar to Railfence; hashes and checksums; compression; regex and string extraction of IPs, domains, and URLs; timestamp conversion; and parsers for IPv6, X.509 certificates, and more. Recipes chain arbitrarily - convert from a hexdump then decompress, decrypt AES pulling the IV from the cipher stream, or let the Magic operation auto-detect several layers of nested encoding. Auto Bake re-runs the recipe live as input or arguments change, Step executes one operation at a time for debugging, and flow control (forks, subsections, registers) applies different operations to different parts of the data. Recipes save to files or share as URLs encoding the full pipeline. Crucially, CyberChef is entirely client-side JavaScript - nothing uploads anywhere - and self-hosting guarantees an unmodified copy inside your own network, where malware artifacts belong.
Benefits
- Sensitive Data Never Leaves
- Entirely client-side processing plus self-hosting means malware samples and internal artifacts stay off third-party sites.
- Hours of Scripting, Skipped
- Multi-stage transforms that would take a Python session - unhex, decompress, decrypt, extract - assemble in seconds by dragging operations.
- Unknown Encodings, Solved
- The Magic operation automatically detects and unwraps several layers of nested encoding when you don't know what you're looking at.
- Analysis You Can Hand Over
- Recipes serialize into URLs and files, so a teammate reproduces your exact pipeline with one click.
Features
- Hundreds of Operations
- Encoding, encryption, hashing, compression, networking parsers, and data extraction in one searchable library.
- Drag-and-Drop Recipes
- Chain operations with arguments; reorder, disable, or repeat steps freely.
- Auto Bake and Step
- Live re-processing on every change, plus single-step execution to inspect each stage.
- Magic Detection
- Automatic identification and unwrapping of nested encodings.
- Flow Control
- Forks, subsections, and registers apply different operations to different parts of the input.
- Shareable and Offline
- Recipe and input encode into URLs; the whole app runs client-side with no server dependency.