CyberChef: GCHQ's Cyber Swiss Army Knife for Data Operations

TL;DR

• CyberChef is a free, open-source web app from GCHQ that bundles hundreds of "cyber" operations (encoding, encryption, compression, hashing, parsing) into one browser-based workbench.
• You build a recipe by dragging operations into a list; CyberChef "bakes" the result instantly as you tweak the input or the steps.
• Everything runs client-side in your browser: input and recipe data are never sent to a server, so it is safe to use on sensitive material and works fully offline.
• It is released under the Apache 2.0 Licence and covered by Crown Copyright, with a hosted site, a downloadable single-file copy, and official Docker images.
• Latest release at the time of writing: v11.2.0.

A note on this page: CyberChef is an independent open-source project by GCHQ (github.com/gchq), the UK Government Communications Headquarters, released under Crown Copyright. It is not built by Navanem. This page is an editorial spotlight published by navanem to introduce the tool and how it works. All credit for the software belongs to GCHQ and the CyberChef contributors.

What is CyberChef?

CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations inside a web browser. GCHQ describes it as the *Cyber Swiss Army Knife*. The project says it was conceived, designed, built and incrementally improved by an analyst working in their 10% innovation time over several years. The goal is to let both technical and non-technical analysts manipulate data in complex ways without wrestling with bespoke tools or hand-rolled scripts for every task.

What can it do?

CyberChef ships with a large catalogue of operations grouped into categorised lists. According to the README, these include simple encoding such as XOR and Base64, more complex encryption such as AES, DES and Blowfish, creating binary and hexdumps, compression and decompression of data, calculating hashes and checksums, IPv6 and X.509 certificate parsing, changing character encodings, and much more. You combine operations into a recipe, so a single workflow can decode, decrypt, decompress and reformat data in sequence rather than across several separate utilities.

How does the recipe model work?

The interface has four main areas: an input box, an output box, an operations list on the far left, and the recipe area in the middle. You drag the operations you want into the recipe and set their arguments. Whenever you change the input or the recipe, Auto Bake runs it immediately and shows the output, though you can switch to manual baking for very large inputs. You can set breakpoints on any operation and step through one stage at a time to inspect the data as it transforms, which makes debugging an encoding chain straightforward.

What are its standout features?

Beyond the recipe model, CyberChef includes a Magic function that uses several techniques to automatically detect which encodings your data is under and suggests an operation to make sense of it. There is drag-and-drop reordering of operations, highlighting that maps offsets between input and output, and the ability to save and load recipes to local storage. Because the URL hash encodes both the recipe and the input, you can copy a link to share a complete workflow. Files up to around 2GB can be dropped straight onto the input box, depending on the browser.

How do you run it?

There is an official hosted version on GitHub Pages that you can use immediately with nothing to install. Because CyberChef is entirely client-side, you can also download a single full copy from the link in the top-left of the app and run it locally, drop it into a virtual machine, share it, or host it on a closed network. For a containerised setup, GCHQ publishes Docker images. To use the pre-built image:

docker run -it -p 8080:8080 ghcr.io/gchq/cyberchef:latest

To build the image yourself from a checkout of the repository:

docker build --tag cyberchef --ulimit nofile=10000 .
docker run -it -p 8080:8080 cyberchef

Then open http://localhost:8080 in your browser. CyberChef also fully supports Node.js v24 through its Node API.

Is it safe for sensitive data?

This is one of CyberChef's defining properties. The README is explicit that none of your recipe configuration or input, whether text or files, is ever sent to the CyberChef web server. All processing is carried out within your browser, on your own computer. That client-side design means you can analyse confidential or regulated material without it leaving your machine, and you can run a downloaded copy entirely offline inside an isolated environment when you need a guarantee that nothing is transmitted.

Who is it for?

CyberChef is built for security analysts, incident responders, malware researchers, CTF players, developers and digital forensics practitioners, but its deliberately approachable design also suits non-technical analysts who just need to decode, convert or inspect data. Anyone who regularly fiddles with Base64 strings, timestamps, hex dumps, certificates or layered encodings will find it faster than stitching together one-off scripts. Browser support targets Google Chrome 50+ and Mozilla Firefox 38+.

FAQ

Is CyberChef made by Navanem?

No. CyberChef is an open-source project created and maintained by GCHQ, the UK Government Communications Headquarters. Navanem did not build it and is not affiliated with it. This page is simply an editorial spotlight; all credit belongs to GCHQ and the project's contributors.

Is CyberChef free and open source?

Yes. CyberChef is released under the Apache 2.0 Licence and is covered by Crown Copyright. The full source code is available on GitHub at github.com/gchq/CyberChef.

Does CyberChef send my data anywhere?

No. CyberChef is entirely client-side. The README states that none of your recipe configuration or input is ever sent to the CyberChef web server; all processing happens in your browser. You can also download and run it offline.

Can I run CyberChef offline or self-host it?

Yes. You can download a single full copy from the app and run it locally, place it in a virtual machine, or host it on a closed network. GCHQ also publishes pre-built Docker images at ghcr.io/gchq/cyberchef:latest, and you can build the image yourself from the repository.

What is the "Magic" operation?

Magic is CyberChef's automated encoding-detection feature. It uses a number of techniques to work out which encodings your data is under and, when it finds a suitable operation, displays a magic icon in the output that you can click to decode the data, including several layers of nested encoding.