CyberChef
Apache-2.0⚖️ Dual Use · JavaScript
CyberChef is a web application developed by GCHQ for carrying out all manner of cyber operations within a web browser. It provides over 300 operations covering encoding/decoding (Base64, URL, hex, HTML entities), encryption/decryption (AES, DES, RSA, XOR), compression (gzip, bzip2, zlib), hashing (MD5, SHA, HMAC), data format conversion (JSON, XML, CSV, YAML), networking (IP parsing, URL parsing, HTTP headers), language operations (regex, character encoding, Unicode), and analysis (entropy, frequency, magic detection). Operations are chained together in a visual 'recipe' that processes data through each step sequentially, making it easy to build complex transformation pipelines. CyberChef's 'Magic' operation automatically detects the encoding or format of input data and suggests relevant operations. It runs entirely client-side - no data leaves the browser - making it safe for processing sensitive material. CyberChef is an essential daily tool for SOC analysts, malware researchers, and CTF players.
Installation
Docker
$ docker run -d -p 8000:8000 ghcr.io/gchq/cyberchef:latestfrom source
$ git clone https://github.com/gchq/CyberChef && cd CyberChef && npm install && npm run buildUse Cases
- Decoding Base64, hex, and URL-encoded strings in malware analysis
- Chaining multiple data transformations into reusable recipes
- Decrypting XOR-encoded malware payloads with visual feedback
- Converting between data formats (JSON, XML, CSV, hex dumps)
- Analyzing entropy and detecting encoding formats with the Magic operation
- Processing sensitive data safely with client-side-only execution
Tags
Details
- Category
- ⚖️ Dual Use
- Language
- JavaScript
- Repository
- gchq/CyberChef
- License
- Apache-2.0
- Platforms
- 🐧linux🍎macos🪟windows
Links
Alternatives & Comparisons
More in Dual Use
ProxyChains-ng
CForce any TCP connection through SOCKS4/5 or HTTP proxies. Chain multiple proxies for anonymity.
Socat
CMultipurpose relay tool. Bidirectional data transfer between two data channels - sockets, files, pipes, devices.
ngrok
GoExpose local servers to the internet via secure tunnels. Instant public URLs for localhost services.
Rclone
Gorsync for cloud storage. Sync, copy, and mount 70+ cloud providers. Command-line Swiss army knife for cloud data.
GTFOBins
ShellCurated list of Unix binaries that can be used to bypass security restrictions. Living off the land, documented.
LOLBAS
ShellLiving Off The Land Binaries, Scripts and Libraries for Windows. Documenting every Windows binary with offensive potential.