Analysis

19 tools that are not CyberChef operations. An operation is a pure run(input, args) over one input, which cannot express an analysis – scoring forty candidate key lengths, or composing several operations and comparing the results. cyberchef_bake does not help, because a recipe is a linear pipeline, not a loop.

These are exposed at every tool surface, including the default index, because they are few and each one replaces a separate command-line tool.

Order and validate an X.509 certificate chain

Order a PEM bundle of X.509 certificates into a chain and report where it breaks: wrong order, a missing intermediate, an expired link, an issuer not permitted to sign, or an issuer whose name and key identifier match while its SIGNATURE does not — the shape of a substituted certificate. Every link is verified CRYPTOGRAPHICALLY: matching names and key identifiers are metadata, and anyone can mint a certificate carrying the ones they like. The three X.509 operations each parse ONE certificate and nothing relates two.

• Tool name: cyberchef_cert_chain
• Category: Analysis

Argument	Type	Default	Description
input	string	required	One or more PEM certificate blocks, in any order. A concatenated bundle — the form fullchain.pem and most servers use — is the expected input.
as_of	string	—	Judge validity at this instant (ISO 8601) instead of now. For asking whether a chain WILL be valid at a future date, or was at an incident’s timestamp.
expiry_warning_days	number	30	Flag any certificate expiring within this many days of the reference time.

Classical ciphers

Encode and decode the classical ciphers CyberChef has no operation for: Playfair, the Polybius square, ADFGVX and Baudot/ITA2 (tap code is a Polybius square, so it is the same tool). Every contested convention is a parameter, because implementations that disagree on one disagree on every message.

• Tool name: cyberchef_classical_cipher
• Category: Encryption / Encoding

Argument	Type	Default	Description
cipher	enum	required	Which cipher.
mode	enum	"encode"	Direction.
input	string	required	The message or ciphertext.
key	string	""	Keyword for the square. Playfair, Polybius and ADFGVX only.
transposition_key	string	""	ADFGVX only: the columnar transposition applied after fractionation. Without it you get only ADFGVX’s first half, a 6x6 Polybius square.
playfair_reduction	enum	"merge_ij"	How Playfair gets 26 letters into 25 squares. merge_ij is canonical; omit_v is dcode.fr’s default.
playfair_filler	string	"X"	The letter inserted between a doubled pair and used to pad an odd length.
playfair_replace_doubles	boolean	false	Bug-compatibility with pycipher, which REPLACES the second letter of a doubled pair rather than inserting a filler. Lossy: it does not round-trip.
polybius_size	number	5	Square size. 5x5 needs a 25-letter alphabet; 6x6 fits 26 letters and 10 digits.
polybius_alphabet	string	""	Override the square’s alphabet. The 6x6 default (letters then digits) is a convention, not a standard, so set this when matching a specific source.
polybius_order	enum	"row_column"	Coordinate order. Row-then-column is canonical.
baudot_profile	enum	"ita2"	Which figures-shift table. They differ in exactly six cells.
baudot_bit_order	enum	"value"	Bit order in each five-bit group. value is Wikipedia’s and dcode’s, transmission is ITU-T S.1’s. If CR and LF come out transposed, use the other.

Corpus difference

Compute statistics ACROSS a set of samples — what a recipe cannot express, since Fork runs each branch separately and nothing combines them. Infers record structure from per-offset byte AND bit variance, grouping adjacent offsets into fields; finds repeated cipher blocks (ECB and any other diffusion-free mode) and reports WHERE they sit; and finds nonce reuse, emitting the XOR of the two bodies, which is both the evidence and the way in. Assumes fixed-length or left-aligned samples.

• Tool name: cyberchef_corpus_diff
• Category: Analysis

Argument	Type	Default	Description
samples	array	required	The samples to compare. At least two; more is better for every statistic.
input_format	enum	"Hex"	How the samples are encoded.
block_size	number	16	Cipher block size for the ECB check. 16 for AES; 8 for DES and Blowfish.
nonce_prefix_bytes	number	12	Leading bytes to treat as the nonce or IV. 12 for GCM, 16 for a CBC IV, 8 for ChaCha20. 0 disables the check.
analyses	array	—	Which analyses to run. All of them by default.

Crib drag

Drag a guessed plaintext fragment along a XOR ciphertext and report every offset where it fits, ranked. With TWO ciphertexts under one key their XOR cancels the key, so a crib guessed in one message yields the matching span of the OTHER. With ONE ciphertext and a known fragment it yields key bytes instead; supply key_length and periodicity becomes a far stronger filter than printability, recovering the whole key when the crib is at least as long as it.

• Tool name: cyberchef_crib_drag
• Category: Analysis

Argument	Type	Default	Description
ciphertext	string	required	The ciphertext to drag along.
ciphertext_b	string	—	A second ciphertext under the SAME key. Every hit is then a span of the other plaintext. Omit it to recover key bytes instead.
crib	string	required	The guessed plaintext fragment, e.g. “ the “.
input_format	enum	"Hex"	How the ciphertexts are encoded. The crib is always literal text.
key_length	number	—	Single-ciphertext mode only: the repeating key’s length, if known. Derived bytes must then agree mod this length, which rejects far more offsets than printability.
top	number	10	How many offsets to report, best first.
printable_only	boolean	true	Report only fully printable results. False when the plaintext is not text.

Cyclic pattern

Generate a De Bruijn (cyclic) pattern, or find the offset of a fragment within one. Compatible with pwntools’ cyclic/cyclic_find, so patterns and offsets are interchangeable with it. Use mode=find with the bytes recovered from a crashed register to get the overflow offset; hex input is interpreted as both big- and little-endian, because a register dump is usually reversed relative to memory.

• Tool name: cyberchef_cyclic_pattern
• Category: Analysis

Argument	Type	Default	Description
mode	enum	required	Generate a pattern, or find an offset in one.
length	number	1024	generate: how many bytes to produce. find: how long the pattern was.
fragment	string	—	find: the bytes recovered, as text or hex (e.g. “aabc” or 0x63626161).
fragment_format	enum	"Auto"	find: how to read fragment. Auto tries hex first, then text.
subsequence_length	number	4	Bytes of uniqueness: 4 for 32-bit, 8 for 64-bit. Must match the pattern.
alphabet	string	"abcdefghijklmnopqrstuvwxyz"	Symbols to build from. The default matches pwntools.

Recover an ECDSA key from a reused nonce

Recover an ECDSA private key from two signatures that reused a nonce, detected by a shared r. Exact algebra, not a search: k = (z1-z2)/(s1±s2), d = (s1·k - z1)/r. Returns up to TWO candidates, because a shared r means the nonce was k or n-k and the pair cannot choose between them without the public key – low-S normalisation makes that common. The four ECDSA operations all work on ONE signature and nothing compares two, which is where ECDSA actually fails — the PS3 firmware key and the 2013 Android Bitcoin thefts were both this. Does NOT attack merely biased nonces; that needs a lattice and is not implemented.

• Tool name: cyberchef_ecdsa_recover
• Category: Analysis

Argument	Type	Default	Description
curve	enum	"secp256k1"	The curve the signatures are over. Only its order n is used, so this must be right — a wrong curve produces a plausible number that verifies against nothing.
signatures	array	required	Two or more signatures over the same key. Every pair sharing an r is reported.

Entropy scan

Find WHERE a file’s entropy is high, not just whether it is: contiguous regions above a threshold, with offsets. CyberChef’s Entropy curve has a fixed 256-byte bin, no threshold and no region output. Applies Lyda and Hamrock’s packed-binary rule (a CONJUNCTION of mean > 6.677 and peak > 7.199, not the single 7.0 usually quoted) and adds chi-squared and serial correlation as a second axis, which is what separates compressed from encrypted. Reports what a high number does and does not establish.

• Tool name: cyberchef_entropy_scan
• Category: Analysis

Argument	Type	Default	Description
input	string	required	The data.
input_format	enum	"Raw"	How input is encoded.
window_bytes	number	256	Window size for the sliding scan. 256 is the sourced figure; a larger window hides encryption that exists only in small areas.
step_bytes	number	—	Distance between windows. Defaults to the window size, i.e. no overlap.
threshold	number	7	Bits per byte above which a window counts as high-entropy. 7.0 is conventional and weak; the report says why.
max_regions	number	32	How many regions to return.

Crack a fast unsalted hash

Recover the plaintext behind a fast unsalted hash from a wordlist: MD5, SHA-1, SHA-256/384/512 and NTLM. Follows hash_identify with the question that matters — is this password one anybody would guess? Deliberately REFUSES bcrypt, scrypt, Argon2, yescrypt and the crypt(3) family BY NAME rather than attempting them, because a pure-JS attempt would find nothing and imply the password was strong. Supply a wordlist; a small common-password list and cheap mutations are built in. Bounded to 20 seconds, about 24 million candidates.

• Tool name: cyberchef_hash_crack
• Category: Analysis

Argument	Type	Default	Description
hashes	array	required	The hashes, as hex. Several share one pass over the wordlist.
algorithm	enum	"auto"	Which digest. auto infers it from the hex length and tries every candidate when that is ambiguous, as it is at 32 characters.
wordlist	array	—	Candidates to try, in order. The built-in common list runs first.
mutations	boolean	true	Capitalise, uppercase, append a digit or year, leetspeak. About 20x the search.
include_common	boolean	true	Try the built-in list of the most-used passwords first.

Identify hash

Identify a password hash by its structure — bcrypt, sha512crypt, argon2, PHPass, Django, LDAP, MySQL, NetNTLM and others — and report the hashcat mode and John format name for each match. Falls back to length-based candidates for a bare digest. Use this before trying to crack something: CyberChef’s Analyse hash operation reads hex length only and reports “Invalid hash” for bcrypt, sha512crypt and argon2.

• Tool name: cyberchef_hash_identify
• Category: Analysis

Argument	Type	Default	Description
input	string	required	The hash, one per call. Whitespace is trimmed.

Hash corpus statistics

Analyse a set of password hashes as a SET: which formats appear and in what proportion, which accounts share a password, which entries are locked or passwordless rather than hashed, and which algorithm is the weakest link. Answers questions that are properties of the corpus rather than of any single hash, so calling hash_identify in a loop cannot produce them. Accepts bare hashes one per line or user:hash records including /etc/shadow. Reads structure only — it never cracks anything and never reaches the network.

• Tool name: cyberchef_hash_statistics
• Category: Analysis

Argument	Type	Default	Description
input	string	required	The corpus: one hash per line, or user:hash records (/etc/shadow works as-is). Blank lines and # comments are skipped. At most 1 MB.
reveal_shared	boolean	true	Report which accounts share a digest. The usernames are echoed back; set false if the output is going somewhere the hashes should not.

JWT weakness scan

Report everything wrong with a JWT that can be established from the token alone. JWT Verify answers whether a signature is valid under a key you supply, which is a different question: alg: none has no signature to verify and one signed with secret verifies perfectly. Checks the algorithm (including the case and Unicode-escape variants that bypass naive filters), an empty signature, the ECDSA psychic signature (CVE-2022-21449), quickstart secrets, and the standard claims. Headers that only matter because of what a SERVER does with them — jku, jwk, x5u, kid — are reported as present, never as confirmed.

• Tool name: cyberchef_jwt_weakness
• Category: Analysis

Argument	Type	Default	Description
token	string	required	The JWT, in compact serialisation.
secrets	array	—	Extra HMAC secrets to try, in addition to the built-in quickstart list. This is a configuration check, not a cracking run — for a wordlist use hashcat mode 16500.
now_seconds	number	—	Unix time to evaluate exp and nbf against. Defaults to the current time.

Plaintext check

Decide whether a candidate is plaintext, and say which evidence decided it. This is the judgement every automatic-decoding search has to make and that no CyberChef operation exposes: Entropy, Chi Square and Index of Coincidence give the statistics, not the verdict. Reports printable ratio, English word hits, chi-squared against English letter frequencies and index of coincidence, with a verdict and the reason for it. Useful as the stopping condition when you are peeling layers off unknown data by hand.

• Tool name: cyberchef_plaintext_check
• Category: Analysis

Argument	Type	Default	Description
input	string	required	The candidate. At most 1 MB.
language	enum	"english"	Which language model to score against. Only English is implemented; the argument exists so a second one does not change the call shape.

Identify a post-quantum key, signature or ciphertext

Identifies NIST post-quantum material – ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) – from a DER/PEM structure or from raw bytes. None of the 504 CyberChef operations covers these. An OID in a SubjectPublicKeyInfo or PrivateKeyInfo gives a DEFINITE answer; raw bytes give a candidate list by length, which is genuinely ambiguous in two documented cases and says so rather than guessing: ML-KEM-1024’s public key and ciphertext are both 1568 bytes, and SLH-DSA public keys (32/48/64) are the same lengths as common hashes and Ed25519 keys. The DER path reads a SubjectPublicKeyInfo or a PrivateKeyInfo – NOT a full X.509 certificate, whose first element is a TBSCertificate; extract the public key first. Identification only – it does no PQC arithmetic.

• Tool name: cyberchef_pqc_identify
• Category: Public Key

Argument	Type	Default	Description
input	string	required	The key, signature or ciphertext. PEM, base64, hex or raw bytes.
input_format	enum	"Auto"	How input is encoded. Auto detects PEM, then hex, then base64, then raw. Prefer PEM, Base64 or Hex for binary: tool arguments travel as UTF-8 JSON strings, so raw bytes can be altered by the client before they arrive here.

RSA key attack

Test an RSA public key for the generation flaws that make it breakable, and recover the private key when one applies: trial division, Fermat (primes too close), shared factors between two moduli, Wiener (private exponent too small), Pollard’s rho (one prime too short), Pollard’s p-1 (a prime whose predecessor is smooth) and unpadded small-e. None threatens a correctly generated key — a sound 2048-bit modulus defeats all of them — so a negative result is evidence the key is not weak in these specific ways, and not that it is strong. Decrypts a supplied ciphertext when the key is recovered.

• Tool name: cyberchef_rsa_attack
• Category: Analysis

Argument	Type	Default	Description
modulus	string	required	The modulus n, as decimal or hex.
public_exponent	string	"65537"	The public exponent e.
ciphertext	string	—	Optional. Decrypted if the private key is recovered.
other_modulus	string	—	A second modulus, to test for a shared prime factor. Breaks both keys if one exists.
attacks	array	—	Which attacks to try. All of them by default, which costs up to 35 seconds of wall clock on a key none of them breaks — the four time-budgeted searches run sequentially, and a soundly generated modulus is exactly the case that reaches all four. Name the ones you want if your client has a shorter per-call timeout. small_factors is trial division and costs nothing; pollard_rho finds a short prime; pollard_pm1 finds a prime whose predecessor is smooth.
pm1_bound	number	50000	Smoothness bound for pollard_pm1. Higher finds primes whose p-1 has a larger factor, and takes proportionally longer.
fermat_iterations	number	100000	Bound on the Fermat search. Higher finds primes that are further apart, and takes longer.

RSA multi-key attack

Attack a SET of RSA keys, or several ciphertexts under one key, for leaks no single key shows: shared primes across a corpus in near-linear time (batch GCD), one message sent twice under one modulus with two exponents (common modulus), one message broadcast under a small exponent (Håstad), and two ciphertexts related by a known linear relation (Franklin–Reiter). Three of the four recover the message without factoring anything. Use rsa_attack for a single key.

• Tool name: cyberchef_rsa_multi_key
• Category: Analysis

Argument	Type	Default	Description
keys	array	required	The keys to attack together. Two suffice for common_modulus and franklin_reiter; Håstad needs at least e; batch_gcd wants as many as you have.
attacks	array	—	Which attacks to try. All of the applicable ones by default.
relation_a	string	"1"	For franklin_reiter: the multiplier in m1 = a*m2 + b. The relation must be KNOWN.
relation_b	string	"1"	For franklin_reiter: the offset in m1 = a*m2 + b.

Break a substitution cipher

Recover a monoalphabetic substitution mapping from ciphertext alone, by hill-climbing on English trigram fitness with random restarts. Substitute needs the mapping and no operation finds one. Also solves Caesar, ROT-N and Atbash. Measured on held-out prose: 83.6% of letters at 150, 91.2% at 250, 95.9% at 350 — so expect one or two letter pairs still swapped. Pin what you can read with known_mapping and run it again.

• Tool name: cyberchef_substitution_break
• Category: Analysis

Argument	Type	Default	Description
input	string	required	The ciphertext. Non-letters are ignored and restored in the output.
restarts	number	120	Independent hill climbs. More is better and slower; the measured figures used 120. Bounded by a 20-second wall clock.
known_mapping	string	""	Letters you already know, as comma-separated cipher:plain pairs, e.g. “q:t,w:h”. Held fixed and never swapped.
seed	number	—	Make the search reproducible. Unset is non-deterministic, which is the right default: a fixed seed that lands in a bad local optimum lands there every time.
preview_letters	number	400	How much decrypted text to return. 0 for none.

Identify a timestamp

Given a number that might be a time, rank every format it could plausibly be — the step before CyberChef’s date operations, which all need you to know the format already. Covers Unix at four resolutions, FILETIME, Chrome/WebKit, .NET ticks, UUIDv1, OLE Automation and Delphi, HFS+, Cocoa and GPS, and takes a v1 UUID directly. Always a ranked list: one 64-bit integer is a valid FILETIME, Cocoa date and nanosecond count at once, so a single confident answer would be wrong by construction.

• Tool name: cyberchef_timestamp_identify
• Category: Analysis

Argument	Type	Default	Description
value	string	required	The number, as decimal, hex, or a version-1 UUID.
plausible_from	string	"1990-01-01"	Earliest date a result may have and still be called plausible, as YYYY-MM-DD.
plausible_to	string	"2040-01-01"	Latest such date.
show_all	boolean	false	Include interpretations outside the window, when the window is what is wrong.

Break a Vigenere cipher

Recover a Vigenere key from ciphertext alone. Vigenère Decode requires the key and no operation finds one. The index of coincidence per coset is used as a FILTER, not a judge — every multiple of the true length scores as well or better, which is the standard way this goes wrong — so a shortlist of lengths is solved in full and the plaintext’s trigram score decides. Runners-up are reported per position, because a close second is where the answer is wrong. Exact key in 9 of 10 measured cases, and it reported its own failure on the tenth rather than a wrong key.

• Tool name: cyberchef_vigenere_break
• Category: Analysis

Argument	Type	Default	Description
input	string	required	The ciphertext. Non-letters are ignored and restored in the output.
max_key_length	number	20	Longest key length to consider.
key_length	number	—	Skip the search and use this length.
preview_letters	number	300	How much decrypted text to return. 0 for none.

XOR key length

Recover the key length of a repeating-key XOR by three independent statistics — index of coincidence, autocorrelation and Kasiski — then score every candidate key byte per column against English and decrypt. Reports what each method concluded, so a disagreement is visible rather than averaged away. CyberChef’s XOR Brute Force stops at a two-byte key. Measured over 72 cases: the exact length in 60%, and the length or a multiple of it — which still decrypts — in 96%. Least reliable on short inputs and on plaintext with its own strong period.

• Tool name: cyberchef_xor_key_length
• Category: Analysis

Argument	Type	Default	Description
input	string	required	The ciphertext. At most 1 MB.
input_format	enum	"Raw"	How input is encoded. Raw treats it as latin1 bytes.
max_key_length	number	32	Longest key length to consider.
candidates	number	5	How many ranked candidates to report.
preview_bytes	number	256	How much decrypted output to return. 0 for none.
assumed_common_byte	number	—	Assume this is the most common plaintext byte in every column (32 for text) and take each column’s most common ciphertext byte to be it. Unset, every candidate key byte is scored against English instead, which needs no assumption.