What It Is
CyberChef is a free, open-source web app from GCHQ, nicknamed "the Cyber Swiss Army Knife". It runs entirely in your browser: nothing you paste into it leaves your machine.
The Layout
Four panes, left to right:
| Pane | What it's for |
|---|---|
| Operations | Every transformation CyberChef knows, with a search box at the top |
| Recipe | The operations you've chosen, applied top to bottom |
| Input | What you paste or drop in (text, or a file such as an EEPROM dump) |
| Output | The result after every step in the recipe |
With Auto Bake ticked (the default), the output updates as you type or change the recipe.
Building a Recipe
-
Find an operation
Type in the search box above the Operations list, e.g.
base64. -
Drag it into the Recipe
Or double-click it. Each operation has its own options right there in the recipe: an alphabet, a key, a delimiter.
-
Stack more steps
Each step works on the output of the one above it, so order matters. Drag steps up or down to reorder them.
-
Look at the middle
Each step has two toggles. A breakpoint stops the recipe there, so the output shows the data just before that step. Disable skips a single step. Halfway checks like these are the fastest way to find which step is wrong.
-
Save what works
The save icon on the Recipe pane exports your recipe; the folder icon loads one back in. The page URL also holds the recipe, so a bookmark keeps it too.
Operations Worth Knowing
A handful of operations cover most of what you'll meet at the booth (and in a lot of CTFs):
| Operation | Does | Example |
|---|---|---|
| From Base64 | Turns Base64 text back into the bytes it encodes | SGVsbG8sIFNBSU5UQ09OIQ== → Hello, SAINTCON! |
| To Base64 | The reverse: bytes to Base64 text | Hello, SAINTCON! → SGVsbG8sIFNBSU5UQ09OIQ== |
| To Hex | Shows each byte as two hex digits, so you can see exactly what's there | Hi! → 48 69 21 |
| From Hex | Turns hex digits back into bytes | 48 69 21 → Hi! |
| XOR | Combines the data with a key, bit by bit (see below) | Hi! XOR key K → bytes 03 22 6a |
| Find / Replace | Search and replace, including regular expressions | Strip a header line, keep only the part you need |
| Magic | Tries common decodings and suggests what the data might be | A good first guess when you don't know what you're looking at |
XOR in a Nutshell
XOR compares two bits and outputs 1 when they
differ, 0 when they match. CyberChef's
XOR operation does that for every bit of your
data against a key. Three things to know:
-
It undoes itself. XOR with a key, then XOR with
the same key again, and you're back where you started:
Hi!→03 22 6a→Hi!. Encrypting and decrypting are the same operation. -
Short keys repeat. If the key is shorter than
the data, CyberChef starts the key over again (the
Standard scheme). XOR
AAAAAAwith the keyABand you get00 03 00 03 00 03: the key's pattern shows straight through. -
Tell it what kind of key you have. The key box
has a format dropdown: UTF8 for text like
KEY, Hex for bytes like4b 45 59, and others. The same characters mean different bytes in each, so pick the one that matches how you got the key.
When the Output Looks Wrong
- Garbage characters? The data is probably binary, not text. Add To Hex at the end to see the actual bytes.
-
Text vs. bytes.
41typed into the input is two characters (34 31), not the byte0x41. Use From Hex to turn hex digits into bytes. - Line endings and stray spaces. Text copied out of other tools often carries Windows line endings (CR LF) and trailing spaces. From Base64's Remove non-alphabet chars option (on by default) skips them; most other operations won't, so trim the input or work on one line at a time.
- Work on one piece at a time. If your data has several parts, paste one in, get its recipe right, then do the rest.
-
Files work too. Drag a
.bin(like a chip dump) onto the Input pane and CyberChef treats it as raw bytes.