CyberChef

Overview

CyberChef is a browser-based “cyber Swiss Army Knife” built by GCHQ. It chains operations (“recipes”) to transform data — encode, decode, hash, encrypt, decompress, extract, and analyse without needing any external tools.

Common Recipes

Encoding / Decoding

From Base64 → To UTF-8
URL Decode
From Hex → Raw bytes
From HTML Entity
JWT Decode

Hashing

MD5, SHA1, SHA256, SHA512 (from the Hash operation)
HMAC (key + data)

Encryption / Decryption

AES Decrypt (provide key + IV)
RC4 Decrypt
XOR with key

CTF / Analysis

Magic → Auto-detect and decode multiple layers
From Decimal / From Binary / From Octal
Extract URLs / Extract IP addresses / Extract email addresses
Regular expression extraction
Strings (find printable strings in binary data)

Magic Operation

The Magic operation auto-detects encodings and applies multiple operations automatically — ideal when you know data is encoded but don’t know how.

CLI Version (Node.js)

Install

npm install -g cyberchef

Use a saved recipe

cyberchef -r recipe.json -i input.txt -o output.txt

CyberChef is primarily web-based.
Available at: https://gchq.github.io/CyberChef
Or self-hosted: download release zip and open index.html

KEY CONCEPTS:
  Recipe     Chain of operations applied in sequence
  Input      Data to process (paste, drag-drop, or load file)
  Output     Result of the recipe
  Operation  Single transformation step

USEFUL OPERATIONS (search in the sidebar):
  Encode: To Base64, To Hex, URL Encode, Escape string
  Decode: From Base64, From Hex, URL Decode, HTML Entity Decode
  Hash:   MD5, SHA1, SHA256, HMAC, bcrypt
  Encrypt: AES, DES, Blowfish, RSA, XOR, ROT13
  Compress: Gunzip, Inflate, Bzip2
  Extract: URLs, IPs, emails, regex matches, strings
  Format:  JSON Beautify/Minify, XML Beautify, YAML to JSON
  Parse:   JWT Decode, Parse Unix timestamp, X.509 cert

SAVING RECIPES:
  Click "Save recipe" (floppy disk icon) to export as JSON
  Share via URL using the # bookmark feature

Vue d’ensemble

CyberChef est un « couteau suisse numérique » basé sur navigateur développé par le GCHQ. Il enchaîne des opérations (« recettes ») pour transformer des données : encoder, décoder, hacher, chiffrer, décompresser, extraire et analyser sans avoir besoin d’outils externes.

Recettes courantes

Encodage / Décodage

From Base64 → To UTF-8
URL Decode
From Hex → Raw bytes
From HTML Entity
JWT Decode

Hachage

MD5, SHA1, SHA256, SHA512 (depuis l'opération Hash)
HMAC (clé + données)

Chiffrement / Déchiffrement

AES Decrypt (fournir clé + IV)
RC4 Decrypt
XOR avec clé

CTF / Analyse

Magic → Détection automatique et décodage de plusieurs couches
From Decimal / From Binary / From Octal
Extract URLs / Extract IP addresses / Extract email addresses
Extraction par expression régulière
Strings (trouver les chaînes imprimables dans les données binaires)

Opération Magic

L’opération Magic détecte automatiquement les encodages et applique plusieurs opérations automatiquement : idéale quand on sait que les données sont encodées mais sans savoir comment.

Version CLI (Node.js)

# Installer
npm install -g cyberchef

# Utiliser une recette sauvegardée
cyberchef -r recipe.json -i input.txt -o output.txt

CyberChef is primarily web-based.
Available at: https://gchq.github.io/CyberChef
Or self-hosted: download release zip and open index.html

KEY CONCEPTS:
  Recipe     Chain of operations applied in sequence
  Input      Data to process (paste, drag-drop, or load file)
  Output     Result of the recipe
  Operation  Single transformation step

USEFUL OPERATIONS (search in the sidebar):
  Encode: To Base64, To Hex, URL Encode, Escape string
  Decode: From Base64, From Hex, URL Decode, HTML Entity Decode
  Hash:   MD5, SHA1, SHA256, HMAC, bcrypt
  Encrypt: AES, DES, Blowfish, RSA, XOR, ROT13
  Compress: Gunzip, Inflate, Bzip2
  Extract: URLs, IPs, emails, regex matches, strings
  Format:  JSON Beautify/Minify, XML Beautify, YAML to JSON
  Parse:   JWT Decode, Parse Unix timestamp, X.509 cert

SAVING RECIPES:
  Click "Save recipe" (floppy disk icon) to export as JSON
  Share via URL using the # bookmark feature