CyberChef

A web app for encoding, encryption, compression, and data analysis that drags operations together in a recipe, built by an analyst over several years.

CyberChef is a web app for encryption, encoding, compression, and data analysis, described on GitHub as the cyber Swiss Army knife. The README says it is a simple intuitive web app for carrying out cyber operations within a web browser. JavaScript is the primary language and the license is Apache-2.0.

Operations cover simple encoding like XOR and Base64, complex encryption like AES, DES, and Blowfish, creating binary and hexdumps, and parsing IPv6 and X.509. Compression and decompression, hashes and checksums, and changing character encodings are also part of the list.

The tool is designed to let both technical and non technical analysts manipulate data in complex ways without dealing with complex tools or algorithms. The README notes that it was conceived, designed, built, and incrementally improved by an analyst in their 10 percent innovation time over several years. The origin story explains the focus on usability.

The interface has an input box for pasting or dragging text or files, an output box for the processing result, an operations list for finding operations, and a recipe area where operations can be dragged and configured. You can chain as many operations as you like, in simple or complex ways.

The examples include decoding a Base64 string, converting a date and time to a different time zone, parsing a Teredo IPv6 address, converting data from a hexdump then decompressing, decrypting and disassembling shellcode, and performing AES decryption with the IV extracted from the cipher stream. The project is built by GCHQ and hosted at gchq.github.io.

The recipe interface is the whole story: chain small operations until the output looks right. That simplicity makes the analyst origin story believable.

• Source 1 · Project repository
• Source 2 · README