What CyberChef Actually Is
CyberChef, built by GCHQ and hosted at gchq.github.io/CyberChef, is a browser-based tool for transforming data — decoding, encoding, hashing, compressing, parsing — through a drag-and-drop pipeline of "recipes." It runs entirely client-side in JavaScript, meaning nothing you paste into it ever leaves your browser, which matters if you're handling sensitive tokens, malware samples, or captured traffic. The interface looks intimidating at first (four panels of operations, recipe, input, and output) but the core workflow is always the same: drag an operation into the recipe area, paste your data into the input box, and watch the output update live.
The Basic Workflow
- Open CyberChef in your browser (it works fully offline once loaded, or you can download the standalone HTML file for air-gapped use).
- In the Operations panel on the left, search for the transform you need (e.g., "From Base64").
- Drag it into the Recipe panel in the center.
- Paste your raw data into the Input box at the bottom left.
- The Output panel updates instantly as you type or adjust operation options — no "run" button needed for most operations (a manual bake toggle exists for expensive recipes).
Decoding Base64
The single most common use case: you've got a chunk of Base64 text and want to see what it actually says. Drag From Base64 into the recipe, paste the string into Input:
U2VydmVyIG1haW50ZW5hbmNlIHNjaGVkdWxlZCBmb3IgMjAyNi0wOC0xOA==Output appears instantly: Server maintenance scheduled for 2026-08-18. To go the other direction, drag To Base64 instead.
Decoding a JWT
JSON Web Tokens are three Base64URL-encoded segments separated by dots (header, payload, signature) — CyberChef has a purpose-built operation rather than making you split and decode manually. Search for JWT Decode and drag it into the recipe, then paste the full token into Input:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cThe output shows the decoded header and payload as formatted JSON, so you can immediately see claims like sub, iat, and any custom fields without writing a script.
Calculating Hashes
Search for SHA2 (or MD5, SHA1, SHA3 — all available as separate operations) and drag it into the recipe. Set the size dropdown to 256 for standard SHA-256, then paste your input text or a file's contents:
Input: hello world
Output: b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcdeYou can also load an actual file directly into the Input panel (drag-and-drop a file, or click the file icon) to hash file contents rather than typed text — useful for quickly verifying a downloaded file's checksum against a published hash without opening a terminal.
Formatting Hex Dumps
Search for To Hex to convert raw text or bytes into a hex representation, with delimiter options (space-separated, comma-separated, or none). For the reverse — turning a hex dump back into readable bytes — use From Hex. Combine this with From Hex followed by a Render Image operation if you're reconstructing an image from a hex dump captured in a packet trace.
Chaining Multiple Operations
The real power of CyberChef shows up when you chain operations, since obfuscated or layered-encoded data rarely comes in a single clean format. A common pattern for CTF challenges or malware analysis: data that's Base64-encoded, then XOR'd, then gzip-compressed. Build that as a recipe by stacking, in order:
- From Base64
- XOR (set the key in the operation's options panel)
- Gunzip
Each operation's output feeds directly into the next one's input, and you can reorder them by dragging, or temporarily disable one with its checkbox to see the intermediate state. This is the workflow that makes CyberChef genuinely earn its "Swiss Army Knife" nickname — reversing multi-layer encoding without writing a single line of code.
Saving and Sharing Recipes
Once you've built a useful recipe, click the Save recipe icon (floppy disk) above the recipe panel to store it locally in your browser for reuse, or click the share link icon to generate a URL that encodes the entire recipe and input — pasting that URL to a colleague reproduces your exact pipeline in their browser instantly.
Wrap-Up
CyberChef replaces a dozen one-off scripts and online converters with a single drag-and-drop interface that runs entirely in your browser — Base64, JWTs, hashes, and hex dumps are one operation away, and layered or obfuscated data becomes a chained recipe instead of a custom script. Since everything processes client-side, it's also the safer default for handling anything sensitive compared to pasting data into random single-purpose decoder websites.
Discussion & Insights