How to Use CyberChef: The Beginner's Guide (2026)

What Is CyberChef?

CyberChef is a free, open source web application for encoding, decoding, encryption, compression and data analysis, built by the UK's GCHQ and released under the Apache 2.0 license. It bundles hundreds of operations into a single page and lets you chain them into sequences called recipes. The project nickname, the Cyber Swiss Army Knife, is doing accurate work for once.

The part that matters most for how you use it: everything runs locally. The project README is explicit that "none of your recipe configuration or input (either text or files) is ever sent to the CyberChef web server, all processing is carried out within your browser, on your own computer". Load the page once and you can turn off your network connection and keep working.

Version 11.4.0 is the current release. There is no account, no paid tier, and no usage limit. You open gchq.github.io/CyberChef and start working.

An honest framing before you get excited about the crypto operations: CyberChef is a spectacular data-wrangling tool and a mediocre cryptanalysis tool. It will decode, defang, parse, extract and reformat faster than any script you could write. It will not break modern encryption, and the beginners who go looking for an "AES Decrypt" button that magically finds the key are about to be disappointed.

The Four Panes, in Sixty Seconds

The interface looks busier than it is. Four panes, and you only interact with three of them.

• Operations (far left). Every available operation, grouped into categories like Data format, Encryption / Encoding, Hashing, Forensics and Flow control. Ignore the categories. Use the search box at the top, because typing "base" gets you to From Base64 faster than any amount of scrolling.
• Recipe (middle). Your chain of operations, running top to bottom. Drag operations in from the left, drag them around to reorder, and drag them out to delete.
• Input (top right). Paste text here, or drag a file directly onto it. Files up to 2GB load straight into the browser.
• Output (bottom right). The result. It updates automatically every time you change anything, a behavior the app calls Auto Bake.

Two controls earn their keep early. The disable icon on each operation lets you switch a step off without deleting it, which is how you test whether a layer is actually needed. The breakpoint icon pauses the recipe before that operation, so you can inspect the intermediate output rather than guessing which step broke the chain.

In practice, the breakpoint is the feature that separates people who fight CyberChef from people who use it. When a five-step recipe returns garbage, setting a breakpoint on step three tells you in one click whether the problem is upstream or downstream.

Your First Recipe: Base64 in Three Clicks

Take that opening string. Paste SGFja2VyRE5Be2ZpcnN0X3JlY2lwZX0= into the input pane, type "base64" into the operation search, and double-click From Base64. The output pane immediately shows:

HackerDNA{first_recipe}

The trailing = is padding, and it is one of the fastest ways to recognize Base64 by eye. A string of mixed-case letters and digits ending in one or two equals signs, with a length divisible by four, is almost always Base64.

Now the version that actually shows up in challenges. Paste this in:

NjY2YzYxNjc3YjZjNjE3OTY1NzI3MzVmNjE2YzZjNWY3NDY4NjU1Zjc3NjE3OTVmNjQ2Zjc3NmU3ZA==

Run From Base64 and the output is not a flag, it is another wall of characters:

666c61677b6c61796572735f616c6c5f7468655f7761795f646f776e7d

That is hexadecimal: only the characters 0 to 9 and a to f, and an even length. Drag From Hex underneath your existing operation and the recipe now runs both steps in order:

flag{layers_all_the_way_down}

This is the whole idea. Each operation hands its output to the next one, so peeling four layers of encoding costs four double-clicks instead of four separate tool invocations. Once a recipe works, the URL in your address bar contains both the recipe and the input, so copying that URL shares the exact working solution with a teammate. Hold that thought, because it has a security consequence covered further down.

Magic: The Operation That Does the Guessing

Magic is a CyberChef operation that inspects your input, works out what encoding it is probably under, and suggests the recipe that decodes it. Drop it into an empty recipe with unknown data in the input, and it returns a ranked list of candidate decodings, each one a clickable link that loads that recipe for you.

It is worth understanding what it is doing, because that tells you when to trust it. According to GCHQ's own wiki on the operation, Magic combines several signals:

• Regular expressions written for each operation whose input has a predictable shape, which is how it spots Base64, hex and Gzip.
• Speculative execution. It actually runs the candidate operations and scores whether the results look like valid data.
• Magic bytes. File signatures at the start of the decoded data, which is how a Base64 blob gets identified as a hidden ZIP or PNG.
• Shannon entropy. Lower entropy means more structure, and structure means the decode probably worked.
• Byte frequency analysis using Pearson's chi-squared test against expected language character frequencies, to judge whether the output reads like real text.

Two arguments change its behavior meaningfully. Depth sets how many levels of recursion it will try, so raising it from the default finds nested encodings that a single pass misses. Intensive mode turns on the slow methods: brute-forcing character encodings across more than 40 options, plus XOR and bit rotation attempts. Depth 3 with Intensive mode ticked is a good default when you are stuck.

My strong take: use Magic first and stop using it second. It is the correct opening move on unknown data, and it is a bad habit as a permanent workflow. Magic fails on multi-byte XOR keys, on Base64 with a custom alphabet, on anything with genuinely high entropy, and on data that decodes to a language it does not check by default. The players who plateau are the ones who type Magic, get nothing, and have no second idea. Learn to recognize the encodings yourself and Magic becomes a shortcut rather than a crutch.

The Recipes Worth Memorizing

Most beginner challenges collapse into a small number of patterns. This table is the one to keep open next to the challenge board.

Three of these deserve more than a table row.

XOR Brute Force

Single-byte XOR is the most common "encryption" in beginner crypto challenges, and it is not encryption at all. Take this hex:

624b49414f586e646b515245587543597544455e754f444958535a5e43454457

Run From Hex, then add XOR Brute Force. It tries every one of the 256 possible single-byte keys and prints the result of each, so you scan the list for the line that reads like English. Here that is key 2a, giving HackerDNA{xor_is_not_encryption}.

The argument that saves real time is Crib. If you know the flag format starts with HackerDNA{ or flag{, put that string in the Crib field and CyberChef shows only keys whose output contains it. On a challenge with 256 candidate lines, that turns scanning into a single result.

Analyse hash

Drop a hash into the input, run Analyse hash, and CyberChef tells you the bit length and the algorithms that produce hashes of that size. A 32 character hex string is MD5 or one of several less common candidates, 40 characters is SHA-1, 64 is SHA-256. CyberChef identifies the hash, it does not crack it, so this is a handoff point rather than a solution. Our guide to cracking password hashes covers the tools that take it from there.

Detect File Type and Extract Files

When a challenge hands you a file with a wrong or missing extension, drag it onto the input pane and run Detect File Type. It reads the magic bytes and tells you what you are actually holding. Follow it with Extract Files and CyberChef pulls out any embedded files it finds inside, which is the browser equivalent of running binwalk -e and often faster for a single sample.

That last pair is where CyberChef crosses into forensics work. If the file turns out to be an image and the flag is not in the metadata, our steganography detection guide picks up from that point.

Three Operations Beginners Never Find

These sit in the Flow control category, which almost nobody opens, and they are what separates the five-minute CyberChef user from the person solving challenges everybody else gave up on.

Fork splits your input on a delimiter and runs the rest of the recipe against each piece independently. Paste a hundred Base64 strings, one per line, add Fork with a newline delimiter, then From Base64, and you decode all hundred at once instead of one at a time. This is the single biggest time saver in the whole tool.

Subsection applies the following operations only to the parts of the input that match a regular expression. When a log file has Base64 blobs scattered inside otherwise readable text, Subsection decodes just the blobs and leaves the surrounding lines intact. Without it you are copying fragments out by hand.

Register captures a value from your data with a regex and stores it for use as an argument in a later operation. That is how you handle a file that carries its own decryption key in a header: capture the key with Register, then reference it in the decrypt step. It takes a few attempts to get comfortable with, and it is the operation that makes CyberChef feel programmable.

None of these are beginner operations in the sense of day one. They are the ones to come back for in week three, when you have hit the wall that they exist to solve.

Where CyberChef Beats the Terminal, and Where It Loses

CyberChef wins on iteration speed. Trying six decoding theories in a Python REPL means six edit-and-rerun cycles. In CyberChef it means six double-clicks with the answer redrawing each time, and the visual chain means you can see where a theory broke instead of inferring it from a traceback. It also works on a locked-down corporate laptop where you cannot install anything, which is a bigger deal than it sounds.

It loses on three things, and it loses badly.

• Large files. Everything lives in browser memory. Multi-hundred-megabyte inputs will make the tab crawl or die, and Auto Bake reprocessing on every keystroke makes it worse. Turn Auto Bake off and bake manually when working with anything big.
• Anything you need to run twice. A recipe is not a script. If a transformation is part of a repeatable process, port it to Python or a shell pipeline. CyberChef is where you work out what the transformation is, not where it should live afterwards.
• Custom logic. The moment your problem needs a loop with a condition CyberChef has no operation for, you are better off writing ten lines of Python than fighting Conditional Jump.

The workflow that actually holds up: prototype in CyberChef, then rewrite the working chain as a script once you know it is correct. The tool is a laboratory, not a production line.

Running CyberChef Offline

The link in the top left of the app downloads a complete standalone copy as a single HTML file. Save it, open it in any browser, and you have the full tool with no network connection at all. Every operation still works, because they always ran locally anyway.

There are two situations where this stops being a convenience and becomes the only acceptable option.

The first is analyzing anything genuinely suspicious. Working from a local file inside an isolated virtual machine keeps the analysis contained, and it removes the risk that a browser extension you forgot about is reading the page.

The second is client or employer data. Even though nothing leaves your machine, most engagement agreements and internal policies draw the line at pasting customer data into any third-party site, and "the processing is client-side" is not an argument you want to be making after the fact. Use the offline copy and the question never comes up.

If you want a shared instance for a team rather than a file per person, GCHQ publishes an official container image:

docker run -it -p 8080:8080 ghcr.io/gchq/cyberchef:latest

That serves the tool on http://localhost:8080 with no external dependency. The offline HTML file is also a useful thing to have on a USB stick before a CTF with unreliable venue Wi-Fi. That has saved more than one team an hour.

Legal and Ethical Considerations

CyberChef itself touches nobody else's system, which puts it in a gentler position than most offensive tooling. The risks are about the data you feed it, and there are two that catch people out.

The first is the shareable URL. When you copy the address bar to send a recipe to a teammate, the URL hash contains your input as well as your recipe. Paste that link into a public Discord, a forum post or a writeup and you have published whatever was in the input pane. This is the most common way people accidentally leak a sample or a credential with this tool, and it is entirely avoidable once you know it happens.

The second is what you do with the output. Decoding a credential you found is trivially easy and does not make the credential yours to use.

Where This Is Clearly Fine

• CTF challenges and training platforms, which is what most of this guide is aimed at
• Files and traffic from systems you own or that a signed engagement covers in writing
• Malware samples inside an isolated analysis environment
• Your own data, including working out what an application stored about you in a cookie

The boundary is not about the tool. If your scope does not name the system the data came from, the data is not yours to decode.

Frequently Asked Questions