| Guide | GDE-020 |
| Topic | CyberChef |
| Domain | Digital forensics |
| Last updated | August 2026 |
Short answer: CyberChef is a free browser-based tool that decodes and transforms obscured data through chained operations. Identify the encoding, chain the relevant operations, and verify the output makes sense before relying on it.
What is CyberChef?
CyberChef is a free browser-based tool for decoding, transforming and analysing data through chained operations such as Base64 decoding, hashing, encryption and format conversion. It answers what an obscured string of text or a captured data blob actually contains, without requiring an investigator to write custom decoding scripts for each new encoding scheme encountered.
OSINT investigations regularly surface data that is not immediately readable: Base64-encoded strings in a URL, hex-encoded values in a leaked file, JWT tokens, or timestamps in an unfamiliar format. CyberChef, built by GCHQ and released as open source, provides a drag-and-drop interface for chaining together over 300 operations, so a multi-step decode that would otherwise require several separate tools or a custom script becomes a single reusable "recipe".
Investigators use CyberChef to decode obscured data found during an investigation, convert between timestamp and encoding formats, and build reusable recipes for data transformations they perform repeatedly, such as decoding a specific platform's token format.
| • | Decoding Base64, hex, URL-encoded or otherwise obscured strings found during an investigation |
| • | Converting between timestamp formats to establish an accurate event time |
| • | Analysing the structure of a JWT token or similar encoded credential |
| • | Building a reusable multi-step decoding recipe for a recurring data format |
| • | Extracting readable content from a captured network request or file fragment |
How do you use CyberChef for OSINT decoding?
Identify the encoding, chain the relevant operations, and verify the output makes sense before relying on it.
Free before paid: CyberChef is entirely free and runs client-side in the browser with no account or installation required.
CyberChef: Free and open source, maintained by GCHQ. Runs entirely in the browser with no data sent to a server, which makes it suitable for sensitive investigative material since nothing leaves the local machine.
CyberChef GitHub repository: Free and open source. The source code and issue tracker, useful for self-hosting an offline copy or checking a specific operation's documented behaviour.
Epoch Converter: Free, no login. A focused companion tool for converting Unix timestamps, useful alongside CyberChef's own "From UNIX Timestamp" operation when cross-checking a converted date.
jwt.io: Free, no login, run by Auth0/Okta. Decodes a JWT's header and payload client-side and can verify its signature against a known secret or public key, useful as a focused cross-check on CyberChef's own JWT parsing when the token's claims or signature validity are the specific thing in question.