CyberChef: A Swiss Army Knife for Anyone Who's Ever Stared at an Encoded Blob
You've got a string of Base64 that might be a JWT, a hexdump you need to decode, or a file you suspect is compressed with something you can't quite identify. Normally that means opening a terminal, remembering which Python library does what, and stringing together half a dozen one-liners. CyberChef is a browser-based alternative: a single web app that handles encoding, encryption, hashing, compression, and parsing without you writing a line of code.
What It Does
CyberChef describes itself as "The Cyber Swiss Army Knife." It's a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. Those operations span a wide range: simple encoding like XOR and Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps, compression and decompression, calculating hashes and checksums, IPv6 and X.509 parsing, changing character encodings, and more.
The tool is designed to enable both technical and non-technical analysts to manipulate data in complex ways without dealing with complex tools or algorithms. It was conceived, designed, built, and incrementally improved by an analyst in their 10% innovation time over several years—which probably explains why it feels less like enterprise software and more like something built by someone who actually had to use it.
The interface is organized around four main areas. There's an input box in the top right where you paste, type, or drag the text or file you want to operate on. From there, you build up a sequence of operations—a "recipe"—that transforms your data step by step. It's a visual pipeline, and you can see the output update as you go.
Why It's Cool
-
No installation, no dependencies, no terminal. It runs entirely in your browser. That's a big deal when you're on a locked-down machine or just don't want to spin up a VM to decode a suspicious string.
-
Recipes are the killer feature. Instead of running one operation at a time, you chain them together. Base64 decode, then XOR, then gunzip, then parse as JSON—all in one view, all visible and editable. It turns a messy multi-step debugging session into something you can actually reason about.
-
It handles the boring stuff too. Character encoding changes, hexdumps, checksums—the kind of tasks you only need occasionally and always forget the exact syntax for. Having them in one place beats googling the same Stack Overflow answer every six months.
-
Deep linking. You can share a recipe as a URL. That means handing a colleague a link that reproduces your exact transformation, which is genuinely useful for incident response or just explaining what you did.
-
Docker support is straightforward. If you'd rather not use the hosted version, you can build the image yourself or pull the pre-built one from GitHub's container registry. Two commands and you're running locally.
-
It's from GCHQ. The UK's signals intelligence agency. That's not a marketing point so much as a signal that it's been used in environments where correctness matters. It's also Apache 2.0 licensed, so you can do what you want with it.
-
Node.js support. It's not just a browser tool. There's an npm package, and you can run it from source if you want to develop against it or integrate it into a pipeline.
How to Try It
The quickest path is the official website—no setup required. If you want to run it locally, you've got two options.
With Docker (no toolchain needed):
docker run -it -p 8080:8080 ghcr.io/gchq/cyberchef:latest
Then navigate to http://localhost:8080.
From source (Node.js v24 required):
git clone https://github.com/gchq/CyberChef.git
cd CyberChef
npm install
npm start
That runs the development server with live reload at http://localhost:8080. Other useful commands:
| Command | Description |
| --- | --- |
| npm run build | Production build in build/prod |
| npm test | Node.js and operation test suites |
| npm run testui | Browser (UI) tests |
| npm run lint | Linting check |
| npm run newop | Scaffold a new operation interactively |
If you hit an out-of-memory error building large recipes, npm run setheapsize bumps Node's heap size.
The repository is at github.com/gchq/CyberChef.
Final Thoughts
CyberChef isn't trying to replace your scripting environment or your favorite CLI tools. It's a focused utility for the moments when you need to inspect, transform, or decode something and you don't want to context-switch into a terminal. It's best suited for analysts, security folks, and developers who regularly deal with encoded or obfuscated data—but honestly, anyone who's ever puzzled over a mysterious string will find it useful. The fact that it's been maintained and improved over years by someone who clearly uses it themselves is the best endorsement you can get.
Follow @githubprojects for more developer tools and open source projects.