GDE-020 |
CyberChef | |||||||
Digital forensics | ||||||||
August 2026 | ||||||||
01
What it is
CyberChef is a free browser-based tool for decoding, transforming and analysing data through chained operations such as Base64 decoding, hashing, encryption and format conversion. It answers what an obscured string of text or a captured data blob actually contains, without requiring an investigator to write custom decoding scripts for each new encoding scheme encountered.
OSINT investigations regularly surface data that is not immediately readable: Base64-encoded strings in a URL, hex-encoded values in a leaked file, JWT tokens, or timestamps in an unfamiliar format. CyberChef, built by GCHQ and released as open source, provides a drag-and-drop interface for chaining together over 300 operations, so a multi-step decode that would otherwise require several separate tools or a custom script becomes a single reusable "recipe".
Investigators use CyberChef to decode obscured data found during an investigation, convert between timestamp and encoding formats, and build reusable recipes for data transformations they perform repeatedly, such as decoding a specific platform's token format.
|
When to use this guide
|
02
How do you use CyberChef for OSINT decoding?
Identify the encoding, chain the relevant operations, and verify the output makes sense before relying on it.
Free before paid. CyberChef is entirely free and runs client-side in the browser with no account or installation required.
CyberChef: Free and open source, maintained by GCHQ. Runs entirely in the browser with no data sent to a server, which makes it suitable for sensitive investigative material since nothing leaves the local machine.
CyberChef GitHub repository: Free and open source. The source code and issue tracker, useful for self-hosting an offline copy or checking a specific operation's documented behaviour.
Epoch Converter: Free, no login. A focused companion tool for converting Unix timestamps, useful alongside CyberChef's own "From UNIX Timestamp" operation when cross-checking a converted date.
jwt.io: Free, no login, run by Auth0/Okta. Decodes a JWT's header and payload client-side and can verify its signature against a known secret or public key, useful as a focused cross-check on CyberChef's own JWT parsing when the token's claims or signature validity are the specific thing in question.
|
Before you begin Stop at the login. CyberChef requires no account, no installation and runs entirely client-side in the browser, meaning no login screen exists to stop at. Because it processes data locally, it is appropriate for sensitive material that should not be transmitted to a third-party server. Legal considerations. Decoding publicly obtained or lawfully accessed data with CyberChef carries no separate legal exposure beyond the exposure of obtaining the underlying data itself. Do not use decoding capability to attempt to defeat encryption or access controls on data you are not otherwise authorised to view. |
Examine the raw string for structural clues: Base64 typically ends in = padding and uses a limited character set, hex is entirely 0-9 and a-f, and a JWT has three dot-separated segments. This initial read guides which operation to try first.
Drag the "Magic" operation onto the recipe area and paste the data into the input pane. Magic attempts multiple common decodings automatically and ranks likely results, useful as a starting point before manually refining the recipe.
Some data is Base64-encoded and then hex-encoded, or similarly layered. Add each decoding operation in sequence to the recipe; CyberChef processes the input through each step in order, so a multi-layer decode is simply multiple operations stacked.
Use "From UNIX Timestamp" or the relevant date operation to convert a raw timestamp value, then cross-check the result against Epoch Converter independently before treating the converted time as confirmed.
Use CyberChef's "Save recipe" feature to store the operation chain as a shareable link or file, so the same multi-step decode can be applied again to similar data without rebuilding it from scratch.
Check whether the decoded output is coherent, such as readable text, a plausible date, or a well-formed JSON structure. Garbled output usually indicates the wrong operation or operation order was applied, not that the underlying data is corrupted.
|
03
What false positives affect CyberChef decoding?
Decoding ambiguity and layered encodings are the most common sources of error.
Coincidental Base64-looking strings that are not actually encoded: Some plain-text strings happen to fall within the valid Base64 character set and will "decode" into garbage rather than meaningful content, which can be mistaken for a failed rather than inapplicable operation. Verifying check: If decoded output is not coherent, confirm the original string is actually the intended encoded value rather than assuming the decoding step itself is broken.
Timestamp format assumptions produce a plausible but wrong date: A numeric value can be validly interpreted as seconds, milliseconds or microseconds since epoch, and choosing the wrong unit produces a date that looks plausible but is wrong by orders of magnitude. Verifying check: Cross-check a converted timestamp against other known event timing from the same source; a date that is decades off or in the future is a strong sign the wrong unit was assumed.
"Magic" operation ranking is a suggestion, not a determination: CyberChef's automatic detection ranks candidate decodings by statistical likelihood, and the top-ranked option is not always correct, particularly for short input strings. Verifying check: Review several of Magic's suggested candidates, not just the top result, and select based on which produces genuinely coherent output.
Character encoding mismatches produce corrupted but readable-looking text: Decoding a UTF-8 string as Latin-1 or vice versa can produce text that looks like a plausible but garbled foreign-language string rather than obviously broken output. Verifying check: If decoded text contains unexpected accented characters or symbols, try the alternate character encoding operation before concluding the source data itself is unusual.
Chain of custody: CyberChef itself does not alter the source data, but the decoding recipe applied is part of the analytical record and should be preserved alongside the original encoded value.
Save the original, unmodified encoded string alongside the decoded output.
Save or export the CyberChef recipe used, so the transformation is reproducible.
Record where the encoded data was originally found, with a timestamp and source URL or file reference.
Screenshot the CyberChef interface showing both input and output for the case record.
Note any manual verification performed on the decoded output, such as a cross-checked timestamp.
04
Go deeper
Reference cards, structured tutorials and tools for practitioners who want to build on this guide.
CARD · OPS-001
OPSEC for investigators: eight-step baseline.
Signal, Mullvad and ProtonMail. Device separation and session documentation to chain-of-custody standard.
METHODS
Legal and ethical boundaries of OSINT.
GDPR Article 6 lawful basis, the journalism exemption, and data minimisation for defensible collection.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.