CyberChef

What CyberChef is

CyberChef is a toolbox for converting data from one form to another. You paste something into a field, drag one or more operations into a recipe, and see the result right away in the box next to it. No code, no commands, just drag and drop.

What is it used for in practice? You have received a text file from a supplier where the Swedish characters show up as question marks and want to know why. You have a list with a hundred rows that needs to become comma-separated. You have a QR code, an image with timestamps in it, a date that appears as a long number, or a string that ends with an equals sign and that someone claims is a password. CyberChef answers that kind of question in under a minute, and does it without you needing to install anything, type a single command, create an account, or even be sure of what you have in front of you when you paste it in.

The tool was built by the British agency GCHQ and released as open source. Everything is calculated in your browser, nothing is sent to any server.

Using CyberChef on Windows and Linux Mint

The fastest option is not to install anything at all. Go to gchq.github.io/CyberChef and start working. The page works identically on Windows and Mint because the whole program is the browser.

If you want a copy that works without internet, for example at a trade fair with a poor connection:

1. Go to the project's releases page on GitHub and download the zip file named something like CyberChef_<version>.zip.
2. Right-click the zip file. On Mint, choose Extract here in the file manager. In File Explorer on Windows, the option is called Extract all instead, and it opens a small dialog where you confirm the folder before the files are unpacked.
3. Open the folder and double-click the html file. CyberChef starts in your regular browser, completely without a network.

Three things to do first

1. Try Magic. Paste something you do not understand into Input and drag in the Magic operation. It guesses what the data is and suggests what to do with it. Quite often it is right.
2. Build a recipe in two steps. Drag in From Base64 and then Extract URLs. Seeing how the operations run from top to bottom is the whole key to the program.
3. Try Save recipe. A recipe you use every week should not be rebuilt every time. The button saves what you have done so that you can bring it up again.

The most common trap

The address bar. When you work, CyberChef puts both the recipe and your input into the web address, so that you can save a bookmark or send a link to someone. It is a practical feature, and it is also the one that does the most damage.

If you paste in a customer register, a login or an account number and then send the link to a colleague, you have sent the entire contents along with it. The same applies if you save the link as a bookmark on a shared computer at the office, or if the address ends up in the browser history that syncs to an account you share.

The rule is simple: never send a CyberChef link that contains real data. If you are going to share a recipe, clear the Input box first and then send. If you are going to work with something sensitive, use the downloaded copy offline.

And remember what encoding is. Base64 is not encryption, just another way of writing the same thing; anyone can read it back. Something that looks complicated is not protected just because it looks complicated.