CyberChef: What It Is, Core Capabilities, and Setup Guide

What it is

CyberChef is an open-source web application created for analyzing, transforming, and decoding diverse digital data formats directly inside an internet browser. Frequently referred to as “The Cyber Swiss Army Knife,” the project provides a unified graphical workspace where people can manipulate text and binary data without writing custom scripts or wrestling with complex algorithmic tools. According to the project README, the software was originally conceived, designed, built, and incrementally improved by an analyst during their ten percent innovation time over several years.

A core architectural principle of CyberChef is that it operates client-side. The entire platform executes locally within the user’s web browser on their own computer. Consequently, data entered into the interface—including typed strings, pasted content, and loaded files—is not transmitted to an external web server for processing. As noted in the project documentation, users can verify this local processing behavior by opening their browser’s developer console with the F12 shortcut and monitoring the Network tab, confirming that no network requests upload data when recipes run.

The official documentation notes only three specific exceptions where network connections reach out to external services: the “Show on map” operation, which downloads geographical map tiles from wikimedia.org; the “DNS over HTTPS” operation, which resolves DNS records through Google or Cloudflare endpoints; and the “HTTP request” operation, which communicates directly with a user-specified web address.

Because CyberChef has no backend server requirements, it can be easily deployed in offline or isolated environments. Users can download the entire application as a standalone ZIP archive, extract it onto a local drive, and open it in a browser without any internet connection. This design allows the application to run smoothly inside virtual machines, air-gapped networks, or private institutional intranets. The project is released under the Apache 2.0 Licence and is covered by Crown Copyright.

What it can do

The CyberChef user interface is divided into four main functional panes:

1. Input Area: Positioned in the upper right, this panel accepts data via keyboard typing, clipboard pasting, file selection, or drag-and-drop actions. Users can load individual files, groups of files, or entire folders. Dragging a folder into the workspace automatically populates each contained file into an individual input tab. To assist with byte-level precision, non-printable characters are represented by dedicated visual control character symbols, such as displaying a null byte (0x00) as ␀. CyberChef can handle files up to roughly 2GB depending on browser capabilities (and at least 500MB depending on hardware), though large inputs can take longer to process. If output data exceeds a default threshold of 1MiB, the platform offers the result as a downloadable file instead of rendering it directly in the window.
2. Operations List: Situated on the far left, this panel catalogs hundreds of operations grouped into organized categories. Users can locate tools by browsing category folders or by typing search terms into a fuzzy matching search box that evaluates both operation names and descriptive text.
3. Recipe Pane: Positioned in the center, this column represents the sequence of processing actions that will transform the input data. For non-programmers, operations function like sequential steps in a baking recipe, while programmers can conceptualize them as a pipeline of functions where the output of each stage feeds into the input of the next. Operations can be dragged into position, reordered, temporarily paused, or removed. The parameters configured inside an operation are called “Ingredients” in CyberChef terminology.
4. Output Area: Situated in the lower right, this panel displays the final transformed output produced by the recipe. Dedicated action buttons allow users to copy raw data directly to the clipboard without browser selection lag, transfer the current output back into the active input tab to start a new transformation sequence, or export all tabbed outputs simultaneously inside a ZIP archive.

Across these panels, CyberChef supports a wide range of analytical and technical transformations:

• Encoding and Decoding: Carrying out everyday operations like XOR routines, Base64 encoding and decoding, character set conversions, and converting binary data into readable hexdumps.
• Cryptography and Hashing: Processing ciphers such as AES, DES, Blowfish, and RC4 (including scenarios where an initialization vector is extracted directly from the start of an encrypted stream), as well as generating hashes and checksums such as SHA3.
• Data Compression and Analysis: Decompressing Gzip archives, parsing specialized network data such as Teredo IPv6 addresses, and inspecting X.509 digital certificates to extract administrative and issuer information.
• Date and Time Adjustments: Converting date and time representations across global time zones and parsing UNIX timestamps into formatted date strings.
• Binary and Machine Code Inspection: Disassembling shellcode for low-level system architectures, including 64-bit and full x86 architectures.
• Flow Control and Logic: The “Fork” operation splits incoming input by lines or custom delimiters so that subsequent recipe steps execute on each item separately. Other flow controls include conditional jumps, returns, labels, and “Register” routines, which extract regex capture groups or input segments to dynamically supply parameters to downstream operations.

CyberChef also incorporates several usability and automation features:

• Auto Bake: By default, CyberChef automatically re-runs the recipe whenever an input, character encoding, or operation configuration changes. Users can turn off Auto Bake to trigger processing manually when working with large data sets.
• Automated Encoding Detection (Magic): The platform features a background detection system known as “Magic” that examines output data up to three layers deep to identify nested encodings. When a plausible decoding path is found, a wand icon appears in the output panel, allowing users to apply the suggested operation with a single click. A dedicated “Magic” operation can also be added directly into recipes for customized inspection depths.
• Breakpoints and Stepping: Users can place breakpoints on any operation within a recipe to pause execution before it runs, or use the “Step” feature to advance through the pipeline one operation at a time to examine intermediate data states.
• Recipe Management and Deep Linking: Recipes can be saved to browser local storage, exported or imported using Clean JSON, Compact JSON, or compact Chef format. Configurations can also be shared using deep links in the URL hash, which encode the recipe, Base64-encoded input, and visual theme.
• Highlighting and Themes: Selecting a byte range in either the input or output displays the offset and length values while automatically highlighting the corresponding segment in the other panel. The visual display can be customized using themes including Classic, Dark, GeoCities, Solarized Dark, and Solarized Light.

How to get started

CyberChef can be accessed online, downloaded for offline use, launched via Docker containers, or compiled directly from source code using Node.js.

Using the Web Application or Offline Archive

The quickest way to start using CyberChef is by navigating to the official hosted application in a web browser at https://gchq.github.io/CyberChef/.

To run the application locally without internet access, select the download link in the top-left corner of the web interface to obtain a ZIP archive. After extracting the files onto a local machine, open the files in any modern web browser to access the complete toolset without needing backend software.

Running with Docker

According to the project documentation, running CyberChef in a container requires Docker Desktop to be installed and active on your system.

To build the Docker image locally from the project repository:

docker build --tag cyberchef --ulimit nofile=10000 .

After building, launch the container:

docker run -it -p 8080:8080 cyberchef

Alternatively, you can run the pre-built image published on the GitHub Container Registry:

docker run -it -p 8080:8080 ghcr.io/gchq/cyberchef:latest

Once the container is active, open http://localhost:8080 in a web browser.

Building from Source with Node.js

For development workflows or running without Docker, CyberChef can be built using Node.js version 24. According to the project documentation, Node Version Manager (nvm) can be used to manage Node environments.

Clone the repository and install project dependencies:

git clone https://github.com/gchq/CyberChef.git
cd CyberChef
npm install

The repository README outlines several standard commands for common tasks:

• Start the development server with live reload at http://localhost:8080:

npm start

• Generate a production build inside the build/prod directory:

npm run build

• Run the Node.js and operation test suites:

npm test

• Run the browser user-interface tests:

npm run testui

• Check the codebase against repository linting rules:

npm run lint

• Scaffold a new operation using the interactive quickstart tool:

npm run newop

• If an out-of-memory error occurs while building large recipes, increase Node’s memory ceiling using:

npm run setheapsize

Pricing and requirements

Pricing and plans are subject to the official page at the CyberChef official website. The application is distributed as free, open-source software under the Apache 2.0 Licence and holds Crown Copyright protection.

System and environment requirements from the project documentation include:

• Web Browsers: CyberChef is built to support Google Chrome version 50 and newer, as well as Mozilla Firefox version 38 and newer.
• Node.js Environment: The software is designed to support Node.js version 24 and includes automated testing against Node.js version 26 ahead of it becoming the active LTS release.
• Docker Environment: A running installation of Docker Desktop is required when choosing containerized deployment.
• Hardware Resources: Because processing is conducted client-side within the browser, the application can handle inputs of 500MB or higher depending on individual machine hardware and browser limits.

Who it is for

CyberChef is designed to assist both technical and non-technical analysts who need to manipulate data in complex ways without managing complicated command-line scripts or algorithmic software.

According to the project documentation, CyberChef is expected to be useful for:

• Cybersecurity and Antivirus Organizations: Teams examining obfuscated data, decoding malware payloads, reviewing cryptographic material, or disassembling shellcode.
• Software Developers: Programmers seeking an interactive scratchpad to quickly prototype data transformations and logic before writing automated scripts.
• Digital Forensic and Data Analysts: Specialists parsing network information such as IPv6 addresses, reviewing timestamps across time zones, or checking X.509 certificate issuers.
• Mathematicians and Academic Researchers: Scholars exploring data formats, compression methods, and cryptographic algorithms.
• Casual Puzzle Solvers: Individuals working on ciphers, encoding puzzles, or general digital data analysis.

Alternatives

DevToys is an offline-focused suite of developer utilities designed for common data formatting and conversion tasks.

IT Tools is an online and self-hosted collection of handy web utilities created for technical tasks.

Sources

• CyberChef GitHub Repository
• CyberChef Official Web Application
• DevToys GitHub Repository
• IT Tools GitHub Repository