Local encoding, hashing and cipher workbench
CyberChef turns data transformations into a recipe: Base64, hex, URL, gzip, JWT inspection, XOR, hash calculations, timestamp conversion — chained operations with the output of one feeding the next. It is a teaching tool and a daily utility at the same time.
It runs entirely in the browser, and the recommended setup is a local copy, so nothing you paste leaves your machine. That matters: encoded data in a decoder on someone else's server is data you have handed over.
Supported platforms
6
Documented install or usage guidance
Learning curve
beginner
Difficulty of becoming productive, not of the underlying theory
Tags
encoding, base64, hashing, recipes, offline
Dataset entry
cyberchef.ts
Reviewed 2025-12-27
Grouped by platform. Elevation requirements are marked per method.
Community-maintained image, useful for a shared lab container.
docker run -d --rm -p 127.0.0.1:8080:80 --name cyberchef mpepping/cyberchef:latest
Grab the release build and open it from disk or a local server; no network required afterwards.
unzip CyberChef*.zip -d cyberchef
python3 -m http.server 8080 --directory cyberchef
The project publishes a hosted build; use it for non-sensitive material.
Open official sourcePackage availability follows your distribution and enabled repositories. Entry revised 27 Dec 2025 — confirm the current release on the project's own download page.
Every command carries its purpose, an example where useful, and the limitations that change how you should read the output.
Recipes are ordered operations; the state of each step is visible, which is the pedagogic value.
From Base64 → Gunzip → Extract Text
Notes
Decode header and payload, check the algorithm field and expiry without sending the token anywhere.
JWT Decode
Reproduce a published checksum when you are verifying a download.
MD5 / SHA-256 (algorithm selector)
Notes
The recipe is encoded in the URL, so a colleague reopens exactly your chain.
Save → Recipe (or copy the #INPUT=… fragment)
See exactly what Base64, URL-encoding and hex do to a string.
Peel a chain of obfuscation layers in a lab sample.
Compute digests offline when no CLI tool is available.
Symptoms you will actually hit, with the cause and the legitimate fix.
Possible causes
Usual fix
Set the correct character encoding on the operation, and inspect the hex view rather than guessing.
Possible causes
Usual fix
Share the recipe JSON (Save → Recipe) separately from the input data.
Where to verify anything on this page. External links open in a new tab.
Binwalk, Hashcat cover adjacent parts of the same job.
