Crypto

66 operations. Call any of them with cyberchef_bake, or pre-load them with CYBERCHEF_TOOL_SURFACE=all.

Adler-32 Checksum

Adler-32 is a checksum algorithm which was invented by Mark Adler in 1995, and is a modification of the Fletcher checksum. Compared to a cyclic redundancy check of the same length, it trades reliability for speed (preferring the latter).Adler-32 is more reliable than Fletcher-16, and slightly less reliable than Fletcher-32.

• Tool name: cyberchef_adler_32_checksum
• Input / output: ArrayBuffer → string
• Arguments: none

Analyse hash

Tries to determine information about a given hash and suggests which algorithm may have been used to generate it based on its length.

• Tool name: cyberchef_analyse_hash
• Input / output: string → string
• Arguments: none

Analyse UUID

Operation for extracting metadata and detecting the version of a given UUID.

• Tool name: cyberchef_analyse_uuid
• Input / output: string → string

Argument	Type	Default
include_metadata	boolean	true

Argon2

Argon2 is a key derivation function that was selected as the winner of the Password Hashing Competition in July 2015. It was designed by Alex Biryukov, Daniel Dinu, and Dmitry Khovratovich from the University of Luxembourg.Enter the password in the input to generate its hash.

• Tool name: cyberchef_argon2
• Input / output: string → string

Argument	Type	Default
salt	toggleString	{"option":"UTF8","string":"somesalt"}
iterations	number	3
memory_kib	number	4096
parallelism	number	1
hash_length_bytes	number	32
type	option	Argon2i
output_format	option	Encoded hash

Argon2 compare

Tests whether the input matches the given Argon2 hash. To test multiple possible passwords, use the ‘Fork’ operation.

• Tool name: cyberchef_argon2_compare
• Input / output: string → string

Argument	Type	Default
encoded_hash	string	—

Ascon Hash

Ascon-Hash256 produces a fixed 256-bit (32-byte) cryptographic hash as standardised in NIST SP 800-232. Ascon is a family of lightweight authenticated encryption and hashing algorithms designed for constrained devices such as IoT sensors and embedded systems.The algorithm was selected by NIST in 2023 as the new standard for lightweight cryptography after a multi-year competition.

• Tool name: cyberchef_ascon_hash
• Input / output: ArrayBuffer → string
• Arguments: none

Ascon MAC

Ascon-Mac produces a 128-bit (16-byte) message authentication code as part of the Ascon family standardised by NIST in SP 800-232. It provides authentication for messages using a secret key, ensuring both data integrity and authenticity.Ascon is designed for lightweight cryptography on constrained devices such as IoT sensors and embedded systems.

• Tool name: cyberchef_ascon_mac
• Input / output: ArrayBuffer → string

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}

Bcrypt

bcrypt is a password hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher, and presented at USENIX in 1999. Besides incorporating a salt to protect against rainbow table attacks, bcrypt is an adaptive function: over time, the iteration count (rounds) can be increased to make it slower, so it remains resistant to brute-force search attacks even with increasing computation power.Enter the password in the input to generate its hash.

• Tool name: cyberchef_bcrypt
• Input / output: string → string

Argument	Type	Default
rounds	number	10

Bcrypt compare

Tests whether the input matches the given bcrypt hash. To test multiple possible passwords, use the ‘Fork’ operation.

• Tool name: cyberchef_bcrypt_compare
• Input / output: string → string

Argument	Type	Default
hash	string	—

Bcrypt parse

Parses a bcrypt hash to determine the number of rounds used, the salt, and the password hash.

• Tool name: cyberchef_bcrypt_parse
• Input / output: string → string
• Arguments: none

CipherSaber2 Decrypt

CipherSaber is a simple symmetric encryption protocol based on the RC4 stream cipher. It gives reasonably strong protection of message confidentiality, yet it’s designed to be simple enough that even novice programmers can memorize the algorithm and implement it from scratch.

• Tool name: cyberchef_ciphersaber2_decrypt
• Input / output: ArrayBuffer → ArrayBuffer

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}
rounds	number	20

CipherSaber2 Encrypt

CipherSaber is a simple symmetric encryption protocol based on the RC4 stream cipher. It gives reasonably strong protection of message confidentiality, yet it’s designed to be simple enough that even novice programmers can memorize the algorithm and implement it from scratch.

• Tool name: cyberchef_ciphersaber2_encrypt
• Input / output: ArrayBuffer → ArrayBuffer

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}
rounds	number	20

CMAC

CMAC is a block-cipher based message authentication code algorithm.RFC4493 defines AES-CMAC that uses AES encryption with a 128-bit key.NIST SP 800-38B suggests usages of AES with other key lengths and Triple DES.

• Tool name: cyberchef_cmac
• Input / output: ArrayBuffer → string

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}
encryption_algorithm	option	AES

Compare CTPH hashes

Compares two Context Triggered Piecewise Hashing (CTPH) fuzzy hashes to determine the similarity between them on a scale of 0 to 100.

• Tool name: cyberchef_compare_ctph_hashes
• Input / output: string → number

Argument	Type	Default
delimiter	option	Line feed

Compare SSDEEP hashes

Compares two SSDEEP fuzzy hashes to determine the similarity between them on a scale of 0 to 100.

• Tool name: cyberchef_compare_ssdeep_hashes
• Input / output: string → number

Argument	Type	Default
delimiter	option	Line feed

CTPH

Context Triggered Piecewise Hashing, also called Fuzzy Hashing, can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length.CTPH was originally based on the work of Dr. Andrew Tridgell and a spam email detector called SpamSum. This method was adapted by Jesse Kornblum and published at the DFRWS conference in 2006 in a paper ‘Identifying Almost Identical Files Using Context Triggered Piecewise Hashing’.

• Tool name: cyberchef_ctph
• Input / output: string → string
• Arguments: none

Derive HKDF key

A simple Hashed Message Authenticaton Code (HMAC)-based key derivation function (HKDF), defined in RFC5869.

• Tool name: cyberchef_derive_hkdf_key
• Input / output: ArrayBuffer → string

Argument	Type	Default
salt	toggleString	{"option":"Hex","string":""}
info	toggleString	{"option":"Hex","string":""}
hashing_function	option	SHA256
extract_mode	argSelector	with salt
l_number_of_output_octets	number	16

Extended GCD

Computes the Extended Euclidean Algorithm for integers a and b.Finds integers x and y (Bezout coefficients) such that:ax + by = gcd(a, b)This is fundamental to many number theory algorithms including modular inverse, solving linear Diophantine equations, and cryptographic operations.Input handling: If either a or b is left blank, its value is taken from the Input field.

• Tool name: cyberchef_extended_gcd
• Input / output: string → string

Argument	Type	Default
value_a	string	—
value_b	string	—

Flask Session Decode

Decodes the payload of a Flask session cookie (itsdangerous) into JSON.

• Tool name: cyberchef_flask_session_decode
• Input / output: string → JSON

Argument	Type	Default
view_timestamp	boolean	false

Flask Session Sign

Signs a JSON payload to produce a Flask session cookie (itsdangerous HMAC).

• Tool name: cyberchef_flask_session_sign
• Input / output: JSON → string

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}
salt	toggleString	{"option":"UTF8","string":"cookie-session"}
algorithm	option	sha1

Flask Session Verify

Verifies the HMAC signature of a Flask session cookie (itsdangerous) generated.

• Tool name: cyberchef_flask_session_verify
• Input / output: string → JSON

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}
salt	toggleString	{"option":"UTF8","string":"cookie-session"}
algorithm	option	sha1
view_timestamp	boolean	true

Fletcher-16 Checksum

The Fletcher checksum is an algorithm for computing a position-dependent checksum devised by John Gould Fletcher at Lawrence Livermore Labs in the late 1970s.The objective of the Fletcher checksum was to provide error-detection properties approaching those of a cyclic redundancy check but with the lower computational effort associated with summation techniques.

• Tool name: cyberchef_fletcher_16_checksum
• Input / output: ArrayBuffer → string
• Arguments: none

Fletcher-32 Checksum

The Fletcher checksum is an algorithm for computing a position-dependent checksum devised by John Gould Fletcher at Lawrence Livermore Labs in the late 1970s.The objective of the Fletcher checksum was to provide error-detection properties approaching those of a cyclic redundancy check but with the lower computational effort associated with summation techniques.

• Tool name: cyberchef_fletcher_32_checksum
• Input / output: ArrayBuffer → string
• Arguments: none

Fletcher-64 Checksum

The Fletcher checksum is an algorithm for computing a position-dependent checksum devised by John Gould Fletcher at Lawrence Livermore Labs in the late 1970s.The objective of the Fletcher checksum was to provide error-detection properties approaching those of a cyclic redundancy check but with the lower computational effort associated with summation techniques.

• Tool name: cyberchef_fletcher_64_checksum
• Input / output: ArrayBuffer → string
• Arguments: none

Fletcher-8 Checksum

The Fletcher checksum is an algorithm for computing a position-dependent checksum devised by John Gould Fletcher at Lawrence Livermore Labs in the late 1970s.The objective of the Fletcher checksum was to provide error-detection properties approaching those of a cyclic redundancy check but with the lower computational effort associated with summation techniques.

• Tool name: cyberchef_fletcher_8_checksum
• Input / output: ArrayBuffer → string
• Arguments: none

Generate all checksums

Generates all available checksums for the input.

• Tool name: cyberchef_generate_all_checksums
• Input / output: ArrayBuffer → string

Argument	Type	Default
length_bits	option	All
include_names	boolean	true

Generate all hashes

Generates all available hashes and checksums for the input.

• Tool name: cyberchef_generate_all_hashes
• Input / output: ArrayBuffer → string

Argument	Type	Default
length_bits	option	All
include_names	boolean	true

Generate UUID

Generates an RFC 9562 (formerly RFC 4122) compliant Universally Unique Identifier (UUID), also known as a Globally Unique Identifier (GUID).We currently support generating the following UUID versions:v1: Timestamp-basedv3: Namespace w/ MD5v4: Random (default)v5: Namespace w/ SHA-1v6: Timestamp, reorderedv7: Unix Epoch time-basedUUIDs are generated using the uuid package.

• Tool name: cyberchef_generate_uuid
• Input / output: string → string

Argument	Type	Default
version	option	v4
namespace	string	1b671a64-40d5-491e-99b0-da01ff1f3341

HAS-160

HAS-160 is a cryptographic hash function designed for use with the Korean KCDSA digital signature algorithm. It is derived from SHA-1, with assorted changes intended to increase its security. It produces a 160-bit output.HAS-160 is used in the same way as SHA-1. First it divides input in blocks of 512 bits each and pads the final block. A digest function updates the intermediate hash value by processing the input blocks in turn.The message digest algorithm consists, by default, of 80 rounds.

• Tool name: cyberchef_has_160
• Input / output: ArrayBuffer → string

Argument	Type	Default
rounds	number	80

HASSH Client Fingerprint

Generates a HASSH fingerprint to help identify SSH clients based on hashing together values from the Client Key Exchange Init message.Input: A hex stream of the SSH_MSG_KEXINIT packet application layer from Client to Server.

• Tool name: cyberchef_hassh_client_fingerprint
• Input / output: string → string

Argument	Type	Default
input_format	option	Hex
output_format	option	Hash digest

HASSH Server Fingerprint

Generates a HASSH fingerprint to help identify SSH servers based on hashing together values from the Server Key Exchange Init message.Input: A hex stream of the SSH_MSG_KEXINIT packet application layer from Server to Client.

• Tool name: cyberchef_hassh_server_fingerprint
• Input / output: string → string

Argument	Type	Default
input_format	option	Hex
output_format	option	Hash digest

HMAC

Keyed-Hash Message Authentication Codes (HMAC) are a mechanism for message authentication using cryptographic hash functions.

• Tool name: cyberchef_hmac
• Input / output: ArrayBuffer → string

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}
hashing_function	option	MD2

JA3 Fingerprint

Generates a JA3 fingerprint to help identify TLS clients based on hashing together values from the Client Hello.Input: A hex stream of the TLS Client Hello packet application layer.

• Tool name: cyberchef_ja3_fingerprint
• Input / output: string → string

Argument	Type	Default
input_format	option	Hex
output_format	option	Hash digest

JA3S Fingerprint

Generates a JA3S fingerprint to help identify TLS servers based on hashing together values from the Server Hello.Input: A hex stream of the TLS Server Hello record application layer.

• Tool name: cyberchef_ja3s_fingerprint
• Input / output: string → string

Argument	Type	Default
input_format	option	Hex
output_format	option	Hash digest

JA4 Fingerprint

Generates a JA4 fingerprint to help identify TLS clients based on hashing together values from the Client Hello.Input: A hex stream of the TLS or QUIC Client Hello packet application layer.

• Tool name: cyberchef_ja4_fingerprint
• Input / output: string → string

Argument	Type	Default
input_format	option	Hex
output_format	option	JA4

JA4Server Fingerprint

Generates a JA4Server Fingerprint (JA4S) to help identify TLS servers or sessions based on hashing together values from the Server Hello.Input: A hex stream of the TLS or QUIC Server Hello packet application layer.

• Tool name: cyberchef_ja4server_fingerprint
• Input / output: string → string

Argument	Type	Default
input_format	option	Hex
output_format	option	JA4S

JWT Decode

Decodes a JSON Web Token without checking whether the provided secret / private key is valid. Use ‘JWT Verify’ to check if the signature is valid as well.

• Tool name: cyberchef_jwt_decode
• Input / output: string → JSON
• Arguments: none

JWT Sign

Signs a JSON object as a JSON Web Token using a provided secret / private key.The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.

• Tool name: cyberchef_jwt_sign
• Input / output: JSON → string

Argument	Type	Default
private_secret_key	text	secret
signing_algorithm	option	HS256
header	text	{}

JWT Verify

Verifies that a JSON Web Token is valid and has been signed with the provided secret / private key.The key should be either the secret for HMAC algorithms or the PEM-encoded public key for RSA and ECDSA.

• Tool name: cyberchef_jwt_verify
• Input / output: string → JSON

Argument	Type	Default
public_secret_key	text	secret

Keccak

The Keccak hash algorithm was designed by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche, building upon RadioGatún. It was selected as the winner of the SHA-3 design competition.This version of the algorithm is Keccak[c=2d] and differs from the SHA-3 specification.

• Tool name: cyberchef_keccak
• Input / output: ArrayBuffer → string

Argument	Type	Default
size	option	512

LM Hash

An LM Hash, or LAN Manager Hash, is a deprecated way of storing passwords on old Microsoft operating systems. It is particularly weak and can be cracked in seconds on modern hardware using rainbow tables.

• Tool name: cyberchef_lm_hash
• Input / output: string → string
• Arguments: none

LS47 Decrypt

This is a slight improvement of the ElsieFour cipher as described by Alan Kaminsky. We use 7x7 characters instead of original (barely fitting) 6x6, to be able to encrypt some structured information. We also describe a simple key-expansion algorithm, because remembering passwords is popular. Similar security considerations as with ElsieFour hold.The LS47 alphabet consists of following characters: _abcdefghijklmnopqrstuvwxyz.0123456789,-+*/:?!’()An LS47 key is a permutation of the alphabet that is then represented in a 7x7 grid used for the encryption or decryption.

• Tool name: cyberchef_ls47_decrypt
• Input / output: string → string

Argument	Type	Default
password	string	—
padding	number	10

LS47 Encrypt

This is a slight improvement of the ElsieFour cipher as described by Alan Kaminsky. We use 7x7 characters instead of original (barely fitting) 6x6, to be able to encrypt some structured information. We also describe a simple key-expansion algorithm, because remembering passwords is popular. Similar security considerations as with ElsieFour hold.The LS47 alphabet consists of following characters: _abcdefghijklmnopqrstuvwxyz.0123456789,-+*/:?!’()A LS47 key is a permutation of the alphabet that is then represented in a 7x7 grid used for the encryption or decryption.

• Tool name: cyberchef_ls47_encrypt
• Input / output: string → string

Argument	Type	Default
password	string	—
padding	number	10
signature	string	—

MD2

The MD2 (Message-Digest 2) algorithm is a cryptographic hash function developed by Ronald Rivest in 1989. The algorithm is optimized for 8-bit computers.Although MD2 is no longer considered secure, even as of 2014, it remains in use in public key infrastructures as part of certificates generated with MD2 and RSA. The message digest algorithm consists, by default, of 18 rounds.

• Tool name: cyberchef_md2
• Input / output: ArrayBuffer → string

Argument	Type	Default
rounds	number	18

MD4

The MD4 (Message-Digest 4) algorithm is a cryptographic hash function developed by Ronald Rivest in 1990. The digest length is 128 bits. The algorithm has influenced later designs, such as the MD5, SHA-1 and RIPEMD algorithms.The security of MD4 has been severely compromised.

• Tool name: cyberchef_md4
• Input / output: ArrayBuffer → string
• Arguments: none

MD5

MD5 (Message-Digest 5) is a widely used hash function. It has been used in a variety of security applications and is also commonly used to check the integrity of files.However, MD5 is not collision resistant and it isn’t suitable for applications like SSL/TLS certificates or digital signatures that rely on this property.

• Tool name: cyberchef_md5
• Input / output: ArrayBuffer → string
• Arguments: none

MD6

The MD6 (Message-Digest 6) algorithm is a cryptographic hash function. It uses a Merkle tree-like structure to allow for immense parallel computation of hashes for very long inputs.

• Tool name: cyberchef_md6
• Input / output: string → string

Argument	Type	Default
size	number	256
levels	number	64
key	string	—

Modular Exponentiation

Performs modular exponentiation, as used in Diffie-Hellman and RSA.Computes Base ^ Exponent mod Modulus.Input handling: If either Base or Exponent is left blank, its value is taken from the Input field.

• Tool name: cyberchef_modular_exponentiation
• Input / output: string → string

Argument	Type	Default
base	string	—
modulus	string	1
exponent	string	—

Modular Inverse

Computes the modular multiplicative inverse of a modulo m.Finds x such that a*x = 1 (mod m).Input handling: If either a or m is left blank, its value is taken from the Input field.

• Tool name: cyberchef_modular_inverse
• Input / output: string → string

Argument	Type	Default
value_a	string	—
modulus_m	string	—

NT Hash

An NT Hash, sometimes referred to as an NTLM hash, is a method of storing passwords on Windows systems. It works by running MD4 on UTF-16LE encoded input. NTLM hashes are considered weak because they can be brute-forced very easily with modern hardware.

• Tool name: cyberchef_nt_hash
• Input / output: string → string
• Arguments: none

Pseudo-Random Prime Generator

Generates a random probable prime number of specified bit length using the Miller-Rabin primality test.Primality guarantee:For numbers . 3,317, the result is guaranteed prime (deterministic test).For larger numbers, uses probabilistic testing:- Standard (7 rounds): Probability of composite approx 1 in 16,000)- Crypto grade (40 rounds): Probability of composite(approx 1 in 10^24)Crypto grade is recommended for cryptographic applications (RSA, Diffie-Hellman, etc.).

• Tool name: cyberchef_pseudo_random_prime_generator
• Input / output: string → string

Argument	Type	Default
bit_length	number	512
crypto_grade	boolean	false
output_format	option	Decimal

RIPEMD

RIPEMD (RACE Integrity Primitives Evaluation Message Digest) is a family of cryptographic hash functions developed in Leuven, Belgium, by Hans Dobbertin, Antoon Bosselaers and Bart Preneel at the COSIC research group at the Katholieke Universiteit Leuven, and first published in 1996.RIPEMD was based upon the design principles used in MD4, and is similar in performance to the more popular SHA-1.

• Tool name: cyberchef_ripemd
• Input / output: ArrayBuffer → string

Argument	Type	Default
size	option	320

Scrypt

scrypt is a password-based key derivation function (PBKDF) created by Colin Percival. The algorithm was specifically designed to make it costly to perform large-scale custom hardware attacks by requiring large amounts of memory. In 2016, the scrypt algorithm was published by IETF as RFC 7914.Enter the password in the input to generate its hash.

• Tool name: cyberchef_scrypt
• Input / output: string → string

Argument	Type	Default
salt	toggleString	{"option":"Hex","string":""}
iterations_n	number	16384
memory_factor_r	number	8
parallelization_factor_p	number	1
key_length	number	64

SHA0

SHA-0 is a retronym applied to the original version of the 160-bit hash function published in 1993 under the name ‘SHA’. It was withdrawn shortly after publication due to an undisclosed ‘significant flaw’ and replaced by the slightly revised version SHA-1. The message digest algorithm consists, by default, of 80 rounds.

• Tool name: cyberchef_sha0
• Input / output: ArrayBuffer → string

Argument	Type	Default
rounds	number	80

SHA1

The SHA (Secure Hash Algorithm) hash functions were designed by the NSA. SHA-1 is the most established of the existing SHA hash functions and it is used in a variety of security applications and protocols.However, SHA-1’s collision resistance has been weakening as new attacks are discovered or improved. The message digest algorithm consists, by default, of 80 rounds.

• Tool name: cyberchef_sha1
• Input / output: ArrayBuffer → string

Argument	Type	Default
rounds	number	80

SHA2

The SHA-2 (Secure Hash Algorithm 2) hash functions were designed by the NSA. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA224, SHA256, SHA384, SHA512.SHA-512 operates on 64-bit words.SHA-256 operates on 32-bit words.SHA-384 is largely identical to SHA-512 but is truncated to 384 bits.SHA-224 is largely identical to SHA-256 but is truncated to 224 bits.SHA-512/224 and SHA-512/256 are truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4. The message digest algorithm for SHA256 variants consists, by default, of 64 rounds, and for SHA512 variants, it is, by default, 160.

• Tool name: cyberchef_sha2
• Input / output: ArrayBuffer → string

Argument	Type	Default
size	argSelector	512
rounds	number	64
rounds	number	160

SHA3

The SHA-3 (Secure Hash Algorithm 3) hash functions were released by NIST on August 5, 2015. Although part of the same series of standards, SHA-3 is internally quite different from the MD5-like structure of SHA-1 and SHA-2.SHA-3 is a subset of the broader cryptographic primitive family Keccak designed by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche, building upon RadioGatún.

• Tool name: cyberchef_sha3
• Input / output: ArrayBuffer → string

Argument	Type	Default
size	option	512

Shake

Shake is an Extendable Output Function (XOF) of the SHA-3 hash algorithm, part of the Keccak family, allowing for variable output length/size.

• Tool name: cyberchef_shake
• Input / output: ArrayBuffer → string

Argument	Type	Default
capacity	option	256
size	number	512

SM2 Decrypt

Decrypts a message utilizing the SM2 standard

• Tool name: cyberchef_sm2_decrypt
• Input / output: string → ArrayBuffer

Argument	Type	Default
private_key	string	DEADBEEF
input_format	option	C1C3C2
curve	option	sm2p256v1

SM2 Encrypt

Encrypts a message utilizing the SM2 standard

• Tool name: cyberchef_sm2_encrypt
• Input / output: ArrayBuffer → string

Argument	Type	Default
public_key_x	string	DEADBEEF
public_key_y	string	DEADBEEF
output_format	option	C1C3C2
curve	option	sm2p256v1

SM3

SM3 is a cryptographic hash function used in the Chinese National Standard. SM3 is mainly used in digital signatures, message authentication codes, and pseudorandom number generators. The message digest algorithm consists, by default, of 64 rounds and length of 256.

• Tool name: cyberchef_sm3
• Input / output: ArrayBuffer → string

Argument	Type	Default
length	number	256
rounds	number	64

Snefru

Snefru is a cryptographic hash function invented by Ralph Merkle in 1990 while working at Xerox PARC. The function supports 128-bit and 256-bit output. It was named after the Egyptian Pharaoh Sneferu, continuing the tradition of the Khufu and Khafre block ciphers.The original design of Snefru was shown to be insecure by Eli Biham and Adi Shamir who were able to use differential cryptanalysis to find hash collisions. The design was then modified by increasing the number of iterations of the main pass of the algorithm from two to eight.

• Tool name: cyberchef_snefru
• Input / output: ArrayBuffer → string

Argument	Type	Default
size	number	128
rounds	option	8

SSDEEP

SSDEEP is a program for computing context triggered piecewise hashes (CTPH). Also called fuzzy hashes, CTPH can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length.SSDEEP hashes are now widely used for simple identification purposes (e.g. the ‘Basic Properties’ section in VirusTotal). Although ‘better’ fuzzy hashes are available, SSDEEP is still one of the primary choices because of its speed and being a de facto standard.This operation is fundamentally the same as the CTPH operation, however their outputs differ in format.

• Tool name: cyberchef_ssdeep
• Input / output: string → string
• Arguments: none

TCP/IP Checksum

Calculates the checksum for a TCP (Transport Control Protocol) or IP (Internet Protocol) header from an input of raw bytes.

• Tool name: cyberchef_tcp_ip_checksum
• Input / output: ArrayBuffer → string
• Arguments: none

Whirlpool

Whirlpool is a cryptographic hash function designed by Vincent Rijmen (co-creator of AES) and Paulo S. L. M. Barreto, who first described it in 2000.Several variants exist:Whirlpool-0 is the original version released in 2000.Whirlpool-T is the first revision, released in 2001, improving the generation of the s-box.Whirlpool is the latest revision, released in 2003, fixing a flaw in the diffusion matrix.

• Tool name: cyberchef_whirlpool
• Input / output: ArrayBuffer → string

Argument	Type	Default
variant	option	Whirlpool
rounds	number	10

XOR Checksum

XOR Checksum splits the input into blocks of a configurable size and performs the XOR operation on these blocks.

• Tool name: cyberchef_xor_checksum
• Input / output: ArrayBuffer → string

Argument	Type	Default
blocksize	number	4