Default

214 operations. Call any of them with cyberchef_bake, or pre-load them with CYBERCHEF_TOOL_SURFACE=all.

ADD

ADD the input with the given key (e.g. fe023da5), MOD 255

• Tool name: cyberchef_add
• Input / output: byteArray → byteArray

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}

Add line numbers

Adds line numbers to the output.

• Tool name: cyberchef_add_line_numbers
• Input / output: string → string

Argument	Type	Default
offset	number	0

Alternating Caps

Alternating caps, also known as studly caps, sticky caps, or spongecase is a form of text notation in which the capitalization of letters varies by some pattern, or arbitrarily. An example of this would be spelling ‘alternative caps’ as ‘aLtErNaTiNg CaPs’.

• Tool name: cyberchef_alternating_caps
• Input / output: string → string
• Arguments: none

AND

AND the input with the given key.e.g. fe023da5

• Tool name: cyberchef_and
• Input / output: byteArray → byteArray

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}

Automated Validation Test Op

Operation used specifically to test automated parameter validation.

• Tool name: cyberchef_automated_validation_test_op
• Input / output: string → string

Argument	Type	Default
integer_number	number	5
real_number	number	1.5
non_empty_string	string	hello
empty_allowed_string	string	—
non_empty_toggle_string	toggleString	{"option":"Option A","string":""}
option_ingredient	option	[Group 1]
arg_selector_ingredient	argSelector	Option 1

Bacon Cipher Decode

Bacon’s cipher or the Baconian cipher is a method of steganography devised by Francis Bacon in 1605. A message is concealed in the presentation of text, rather than its content.

• Tool name: cyberchef_bacon_cipher_decode
• Input / output: string → string

Argument	Type	Default
alphabet	option	Standard (I=J and U=V)
translation	option	0/1
invert_translation	boolean	false

Bacon Cipher Encode

Bacon’s cipher or the Baconian cipher is a method of steganography devised by Francis Bacon in 1605. A message is concealed in the presentation of text, rather than its content.

• Tool name: cyberchef_bacon_cipher_encode
• Input / output: string → string

Argument	Type	Default
alphabet	option	Standard (I=J and U=V)
translation	option	0/1
keep_extra_characters	boolean	false
invert_translation	boolean	false

Bit shift left

Shifts the bits in each byte towards the left by the specified amount.

• Tool name: cyberchef_bit_shift_left
• Input / output: ArrayBuffer → ArrayBuffer

Argument	Type	Default
amount	number	1

Bit shift right

Shifts the bits in each byte towards the right by the specified amount.Logical shifts replace the leftmost bits with zeros.Arithmetic shifts preserve the most significant bit (MSB) of the original byte keeping the sign the same (positive or negative).

• Tool name: cyberchef_bit_shift_right
• Input / output: ArrayBuffer → ArrayBuffer

Argument	Type	Default
amount	number	1
type	option	Logical shift

Caret/M-decode

Decodes caret or M-encoded strings, i.e. ^M turns into a newline, M-^] turns into 0x9d. Sources such as cat -v. Please be aware that when using cat -v ^_ (caret-underscore) will not be encoded, but represents a valid encoding (namely that of 0x1f).

• Tool name: cyberchef_caret_m_decode
• Input / output: string → byteArray
• Arguments: none

Cartesian Product

Calculates the cartesian product of multiple sets of data, returning all possible combinations.

• Tool name: cyberchef_cartesian_product
• Input / output: string → string

Argument	Type	Default
sample_delimiter	binaryString	\n\n
item_delimiter	binaryString	,

Change IP format

Convert an IP address from one format to another, e.g. 172.20.23.54 to ac141736

• Tool name: cyberchef_change_ip_format
• Input / output: string → string

Argument	Type	Default
input_format	option	Dotted Decimal
output_format	option	Dotted Decimal

Chi Square

Calculates the Chi Square distribution of values.

• Tool name: cyberchef_chi_square
• Input / output: ArrayBuffer → number
• Arguments: none

Comment

Provides a place to write comments within the flow of the recipe. This operation has no computational effect.

• Tool name: cyberchef_comment
• Input / output: string → string
• Flow control: yes

Argument	Type	Default
``	text	—

Conditional Jump

Conditionally jump forwards or backwards to the specified Label based on whether the data matches the specified regular expression.

• Tool name: cyberchef_conditional_jump
• Input / output: string → string
• Flow control: yes

Argument	Type	Default
match_regex	string	—
invert_match	boolean	false
label_name	shortString	—
maximum_jumps_if_jumping_backwards	number	10

Convert area

Converts a unit of area to another format.

• Tool name: cyberchef_convert_area
• Input / output: BigNumber → BigNumber

Argument	Type	Default
input_units	option	[Metric]
output_units	option	[Metric]

Convert data units

Converts a unit of data to another format.

• Tool name: cyberchef_convert_data_units
• Input / output: BigNumber → BigNumber

Argument	Type	Default
input_units	option	Bits (b)
output_units	option	Bits (b)

Convert distance

Converts a unit of distance to another format.

• Tool name: cyberchef_convert_distance
• Input / output: BigNumber → BigNumber

Argument	Type	Default
input_units	option	[Metric]
output_units	option	[Metric]

Convert Leet Speak

Converts to and from Leet Speak.

• Tool name: cyberchef_convert_leet_speak
• Input / output: string → string

Argument	Type	Default
direction	option	To Leet Speak

Convert mass

Converts a unit of mass to another format.

• Tool name: cyberchef_convert_mass
• Input / output: BigNumber → BigNumber

Argument	Type	Default
input_units	option	[Metric]
output_units	option	[Metric]

Convert speed

Converts a unit of speed to another format.

• Tool name: cyberchef_convert_speed
• Input / output: BigNumber → BigNumber

Argument	Type	Default
input_units	option	[Metric]
output_units	option	[Metric]

Convert to NATO alphabet

Converts characters to their representation in the NATO phonetic alphabet.

• Tool name: cyberchef_convert_to_nato_alphabet
• Input / output: string → string
• Arguments: none

Count occurrences

Counts the number of times the provided string occurs in the input.

• Tool name: cyberchef_count_occurrences
• Input / output: string → number

Argument	Type	Default
search_string	toggleString	{"option":"Regex","string":""}

CRC Checksum

A Cyclic Redundancy Check (CRC) is an error-detecting code commonly used in digital networks and storage devices to detect accidental changes to raw data.

• Tool name: cyberchef_crc_checksum
• Input / output: ArrayBuffer → string

Argument	Type	Default
algorithm	argSelector	Custom
width_bits	toggleString	{"option":"Decimal","string":"0"}
polynomial	toggleString	{"option":"Hex","string":"0"}
initialization	toggleString	{"option":"Hex","string":"0"}
reflect_input	option	True
reflect_output	option	True
xor_output	toggleString	{"option":"Hex","string":"0"}

CSV to JSON

Converts a CSV file to JSON format.

• Tool name: cyberchef_csv_to_json
• Input / output: string → JSON

Argument	Type	Default
cell_delimiters	binaryShortString	,
row_delimiters	binaryShortString	\r\n
format	option	Array of dictionaries

DateTime Delta

Calculates a new DateTime value given an input DateTime value and a time difference (delta) from the input DateTime value.

• Tool name: cyberchef_datetime_delta
• Input / output: string → html

Argument	Type	Default
built_in_formats	populateOption	DD/MM/YYYY HH:mm:ss
input_format_string	binaryString	DD/MM/YYYY HH:mm:ss
time_operation	option	Add
days	number	0
hours	number	0
minutes	number	0
seconds	number	0

Dechunk HTTP response

Parses an HTTP response transferred using Transfer-Encoding: Chunked

• Tool name: cyberchef_dechunk_http_response
• Input / output: string → string
• Arguments: none

Decode NetBIOS Name

NetBIOS names as seen across the client interface to NetBIOS are exactly 16 bytes long. Within the NetBIOS-over-TCP protocols, a longer representation is used.There are two levels of encoding. The first level maps a NetBIOS name into a domain system name. The second level maps the domain system name into the ‘compressed’ representation required for interaction with the domain name system.This operation decodes the first level of encoding. See RFC 1001 for full details.

• Tool name: cyberchef_decode_netbios_name
• Input / output: byteArray → byteArray

Argument	Type	Default
offset	number	65

Defang IP Addresses

Takes a IPv4 or IPv6 address and ‘Defangs’ it, meaning the IP becomes invalid, removing the risk of accidentally utilising it as an IP address.

• Tool name: cyberchef_defang_ip_addresses
• Input / output: string → string
• Arguments: none

Defang URL

Takes a Universal Resource Locator (URL) and ‘Defangs’ it; meaning the URL becomes invalid, neutralising the risk of accidentally clicking on a malicious link.This is often used when dealing with malicious links or IOCs.Works well when combined with the ‘Extract URLs’ operation.

• Tool name: cyberchef_defang_url
• Input / output: string → string

Argument	Type	Default
escape_dots	boolean	true
escape_http	boolean	true
escape	boolean	true
process	option	Valid domains and full URLs

Detect File Type

Attempts to guess the MIME (Multipurpose Internet Mail Extensions) type of the data based on ‘magic bytes’.Currently supports the following file types: 123d, 7z, B64, abcdp, accda, accdb, accde, accdu, ace, ai, aif, aifc, alz, amr, arj, arw, au, auf, avi, axf, bash, bct, bin, bitlocker, bk!, bmp, bplist, bz2, cab, cat, cer, chi, chm, chw, class, com, cr2, crl, crt, crw, crx, db, dbx, deb, der, dex, dll, dmf, dmg, dmp, doc, docx, dot, drv, dwg, dwt, dylib, edb, elf, eot, eps, epub, evt, evtx, exe, f4v, fdb, flac, flv, fon, gif, gpg, gz, hbin, hdr, heic, heif, hqx, ichat, ico, ipmeta, iso, jar, job, jpe, jpeg, jpg, jxr, keychain, kgb, lnk, luac, lzo, lzop, m4a, m4v, mda, mdb, mdbackup, mde, mdi, mdinfo, mdt, midi, mkv, mov, mp3, mp4, mpg, mpo, mrw, msg, msi, nib, o, ocx, ogg, ogm, ogv, ogx, ole2, one, opus, ost, otf, p7b, p7c, p7m, p7s, pab, pdf, pf, pfa, pgd, phar, php, php-s, php3, php4, php5, php7, phps, pht, phtml, pkr, pl, plist, pm, png, pod, pot, ppa, pps, ppt, pptx, prx, ps, psa, psb, psd, psp, pst, pwl, py, pyc, pyd, pyo, pyw, pyz, qtz, raf, rar, rb, registry, rgs, rsa, rtf, scr, sdw, sh, skr, sml, so, sqlite, strings, swf, swz, sys, t, tar, tar.z, tcp, tga, thm, tif, torrent, ttf, txt, udp, utf16le, utf32le, vbx, vhd, vmdk, vsd, vxd, wallet, wasm, wav, wcm, webbookmark, webhistory, webm, webp, wmv, woff, woff2, wp, wp5, wp6, wpd, wpp, xcf, xla, xls, xlsx, xz, zip, zlib.

• Tool name: cyberchef_detect_file_type
• Input / output: ArrayBuffer → string

Argument	Type	Default
images	boolean	true
video	boolean	true
audio	boolean	true
documents	boolean	true
applications	boolean	true
archives	boolean	true
miscellaneous	boolean	true

Divide

Divides a list of numbers. If an item in the string is not a number it is excluded from the list.e.g. 0x0a 8 .5 becomes 2.5

• Tool name: cyberchef_divide
• Input / output: string → BigNumber

Argument	Type	Default
delimiter	option	Line feed

DNS over HTTPS

Takes a single domain name and performs a DNS lookup using DNS over HTTPS. By default, Cloudflare and Google DNS over HTTPS services are supported. Can be used with any service that supports the GET parameters name and type.

• Tool name: cyberchef_dns_over_https
• Input / output: string → JSON

Argument	Type	Default
resolver	editableOption	https://dns.google.com/resolve
request_type	option	A
answer_data_only	boolean	false
disable_dnssec_validation	boolean	false

Drop bytes

Cuts a slice of the specified number of bytes out of the data. Negative values are allowed.

• Tool name: cyberchef_drop_bytes
• Input / output: ArrayBuffer → ArrayBuffer

Argument	Type	Default
start	number	0
length	number	5
apply_to_each_line	boolean	false

Drop nth bytes

Drops every nth byte starting with a given byte.

• Tool name: cyberchef_drop_nth_bytes
• Input / output: byteArray → byteArray

Argument	Type	Default
drop_every	number	4
starting_at	number	0
apply_to_each_line	boolean	false

ELF Info

Implements readelf-like functionality. This operation will extract the ELF Header, Program Headers, Section Headers and Symbol Table for an ELF file.

• Tool name: cyberchef_elf_info
• Input / output: ArrayBuffer → string
• Arguments: none

Encode NetBIOS Name

NetBIOS names as seen across the client interface to NetBIOS are exactly 16 bytes long. Within the NetBIOS-over-TCP protocols, a longer representation is used.There are two levels of encoding. The first level maps a NetBIOS name into a domain system name. The second level maps the domain system name into the ‘compressed’ representation required for interaction with the domain name system.This operation carries out the first level of encoding. See RFC 1001 for full details.

• Tool name: cyberchef_encode_netbios_name
• Input / output: byteArray → byteArray

Argument	Type	Default
offset	number	65

Escape Smart Characters

Converts smart (typographic) Unicode characters — e.g. smart quotes, em/en dashes, ellipses, ©, ®, ™, arrows — into their plain ASCII equivalents.Characters with no ASCII mapping (e.g. ☣) are handled according to the ‘Unmappable characters’ option.e.g. “Hello” — world… becomes “Hello” – world…

• Tool name: cyberchef_escape_smart_characters
• Input / output: string → string

Argument	Type	Default
unmappable_characters	option	Include

Escape string

Escapes special characters in a string so that they do not cause conflicts. For example, Don’t stop me now becomes Don't stop me now.Supports the following escape sequences:\n (Line feed/newline)\r (Carriage return)\t (Horizontal tab)\b (Backspace)\f (Form feed)\xnn (Hex, where n is 0-f)\ (Backslash)' (Single quote)" (Double quote)\unnnn (Unicode character)\u{nnnnnn} (Unicode code point)

• Tool name: cyberchef_escape_string
• Input / output: string → string

Argument	Type	Default
escape_level	option	Special chars
escape_quote	option	Single
json_compatible	boolean	false
es6_compatible	boolean	true
uppercase_hex	boolean	false

Escape Unicode Characters

Converts characters to their unicode-escaped notations.Supports the prefixes:\u%uU+e.g. σου becomes \u03C3\u03BF\u03C5

• Tool name: cyberchef_escape_unicode_characters
• Input / output: string → string

Argument	Type	Default
prefix	option	\u
encode_all_chars	boolean	false
padding	number	4
uppercase_hex	boolean	true

Expand alphabet range

Expand an alphabet range string into a list of the characters in that range.e.g. a-z becomes abcdefghijklmnopqrstuvwxyz.

• Tool name: cyberchef_expand_alphabet_range
• Input / output: string → string

Argument	Type	Default
delimiter	binaryString	—

Extract Audio Metadata

Extract common audio metadata across MP3 (ID3v2/ID3v1/GEOB), WAV/BWF/BW64 (INFO/bext/iXML/axml), FLAC (Vorbis Comment/Picture), OGG (Vorbis/OpusTags), AAC (ADTS), AC3 (Dolby Digital), WMA (ASF), plus best-effort MP4/M4A and AIFF scanning. Outputs normalized JSON.

• Tool name: cyberchef_extract_audio_metadata
• Input / output: ArrayBuffer → html

Argument	Type	Default
filename_optional	string	—
max_embedded_text_bytes_ixml_axml_etc	number	524288

Extract Files

Performs file carving to attempt to extract files from the input.This operation is currently capable of carving out the following formats: JPG,JPEG,JPE,THM,MPOGIFPNGWEBPBMPICOTGAFLVWAVMP3PDFRTFDOCX,XLSX,PPTXEPUBEXE,DLL,DRV,VXD,SYS,OCX,VBX,COM,FON,SCRELF,BIN,AXF,O,PRX,SODYLIBZIPTARGZBZ2ZLIBXZJARLZOP,LZODEBSQLITEEVTEVTXDMPPFPLISTKEYCHAINLNK Minimum File Size can be used to prune small false positives.

• Tool name: cyberchef_extract_files
• Input / output: ArrayBuffer → html

Argument	Type	Default
images	boolean	true
video	boolean	true
audio	boolean	true
documents	boolean	true
applications	boolean	true
archives	boolean	true
miscellaneous	boolean	false
ignore_failed_extractions	boolean	true
minimum_file_size	number	100

Extract ID3

This operation extracts ID3 metadata from an MP3 file.ID3 is a metadata container most often used in conjunction with the MP3 audio file format. It allows information such as the title, artist, album, track number, and other information about the file to be stored in the file itself.

• Tool name: cyberchef_extract_id3
• Input / output: ArrayBuffer → html
• Arguments: none

Fang URL

Takes a ‘Defanged’ Universal Resource Locator (URL) and ‘Fangs’ it. Meaning, it removes the alterations (defanged) that render it useless so that it can be used again.

• Tool name: cyberchef_fang_url
• Input / output: string → string

Argument	Type	Default
restore	boolean	true
restore_hxxp	boolean	true
restore	boolean	true

Fernet Decrypt

Fernet is a symmetric encryption method which makes sure that the message encrypted cannot be manipulated/read without the key. It uses URL safe encoding for the keys. Fernet uses 128-bit AES in CBC mode and PKCS7 padding, with HMAC using SHA256 for authentication. The IV is created from os.random().Key: The key must be 32 bytes (256 bits) encoded with Base64.

• Tool name: cyberchef_fernet_decrypt
• Input / output: string → string

Argument	Type	Default
key	string	—

Fernet Encrypt

Fernet is a symmetric encryption method which makes sure that the message encrypted cannot be manipulated/read without the key. It uses URL safe encoding for the keys. Fernet uses 128-bit AES in CBC mode and PKCS7 padding, with HMAC using SHA256 for authentication. The IV is created from os.random().Key: The key must be 32 bytes (256 bits) encoded with Base64.

• Tool name: cyberchef_fernet_encrypt
• Input / output: string → string

Argument	Type	Default
key	string	—

File Tree

Creates a file tree from a list of file paths (similar to the tree command in Linux)

• Tool name: cyberchef_file_tree
• Input / output: string → string

Argument	Type	Default
file_path_delimiter	binaryString	/
delimiter	option	Line feed

Fork

Split the input data up based on the specified delimiter and run all subsequent operations on each branch separately.For example, to decode multiple Base64 strings, enter them all on separate lines then add the ‘Fork’ and ‘From Base64’ operations to the recipe. Each string will be decoded separately.

• Tool name: cyberchef_fork
• Input / output: string → string
• Flow control: yes

Argument	Type	Default
split_delimiter	binaryShortString	\n
merge_delimiter	binaryShortString	\n
ignore_errors	boolean	false

Format MAC addresses

Displays given MAC addresses in multiple different formats.Expects addresses in a list separated by newlines, spaces or commas.WARNING: There are no validity checks.

• Tool name: cyberchef_format_mac_addresses
• Input / output: string → string

Argument	Type	Default
output_case	option	Both
no_delimiter	boolean	true
dash_delimiter	boolean	true
colon_delimiter	boolean	true
cisco_style	boolean	false
ipv6_interface_id	boolean	false

Frequency distribution

Displays the distribution of bytes in the data as a graph.

• Tool name: cyberchef_frequency_distribution
• Input / output: ArrayBuffer → html

Argument	Type	Default
show_0_s	boolean	true
show_ascii	boolean	true

From Base

Converts a number to decimal from a given numerical base.

• Tool name: cyberchef_from_base
• Input / output: string → BigNumber

Argument	Type	Default
radix	number	36

From Base32

Base32 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers. It uses a smaller set of characters than Base64, usually the uppercase alphabet and the numbers 2 to 7.

• Tool name: cyberchef_from_base32
• Input / output: string → byteArray

Argument	Type	Default
alphabet	editableOption	A-Z2-7=
remove_non_alphabet_chars	boolean	true

From Base45

Base45 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers. The high number base results in shorter strings than with the decimal or hexadecimal system. Base45 is optimized for usage with QR codes.

• Tool name: cyberchef_from_base45
• Input / output: string → byteArray

Argument	Type	Default
alphabet	string	0-9A-Z $%*+\-./:
remove_non_alphabet_chars	boolean	true

From Base58

Base58 (similar to Base64) is a notation for encoding arbitrary byte data. It differs from Base64 by removing easily misread characters (i.e. l, I, 0 and O) to improve human readability.This operation decodes data from an ASCII string (with an alphabet of your choosing, presets included) back into its raw form.e.g. StV1DL6CwTryKyV becomes hello worldBase58 is commonly used in cryptocurrencies (Bitcoin, Ripple, etc).

• Tool name: cyberchef_from_base58
• Input / output: string → byteArray

Argument	Type	Default
alphabet	editableOption	123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnop
remove_non_alphabet_chars	boolean	true

From Base62

Base62 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers. The high number base results in shorter strings than with the decimal or hexadecimal system.

• Tool name: cyberchef_from_base62
• Input / output: string → byteArray

Argument	Type	Default
alphabet	string	0-9A-Za-z

From Base64

Base64 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers.This operation decodes data from an ASCII Base64 string back into its raw format.e.g. aGVsbG8= becomes hello

• Tool name: cyberchef_from_base64
• Input / output: string → byteArray

Argument	Type	Default
alphabet	editableOption	A-Za-z0-9+/=
remove_non_alphabet_chars	boolean	true
strict_mode	boolean	false

From Base85

Base85 (also called Ascii85) is a notation for encoding arbitrary byte data. It is usually more efficient that Base64.This operation decodes data from an ASCII string (with an alphabet of your choosing, presets included).e.g. BOu!rD]j7BEbo7 becomes hello worldBase85 is commonly used in Adobe’s PostScript and PDF file formats.

• Tool name: cyberchef_from_base85
• Input / output: string → byteArray

Argument	Type	Default
alphabet	editableOption	!-u
remove_non_alphabet_chars	boolean	true
all_zero_group_char	binaryShortString	z

From Base92

Base92 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers.

• Tool name: cyberchef_from_base92
• Input / output: string → byteArray
• Arguments: none

From BCD

Binary-Coded Decimal (BCD) is a class of binary encodings of decimal numbers where each decimal digit is represented by a fixed number of bits, usually four or eight. Special bit patterns are sometimes used for a sign.

• Tool name: cyberchef_from_bcd
• Input / output: string → BigNumber

Argument	Type	Default
scheme	option	8 4 2 1
packed	boolean	true
signed	boolean	false
input_format	option	Nibbles

From Bech32

Bech32 is an encoding scheme primarily used for Bitcoin SegWit addresses (BIP-0173). It uses a 32-character alphabet that excludes easily confused characters (1, b, i, o) and includes a checksum for error detection.Bech32m (BIP-0350) is an updated version used for Bitcoin Taproot addresses.Auto-detect will attempt Bech32 first, then Bech32m if the checksum fails.Output format options allow you to see the Human-Readable Part (HRP) along with the decoded data.

• Tool name: cyberchef_from_bech32
• Input / output: string → string

Argument	Type	Default
encoding	option	Auto-detect
output_format	option	Raw

From Binary

Converts a binary string back into its raw form.e.g. 01001000 01101001 becomes Hi

• Tool name: cyberchef_from_binary
• Input / output: string → byteArray

Argument	Type	Default
delimiter	option	Space
byte_length	number	8

From Braille

Converts six-dot braille symbols to text.

• Tool name: cyberchef_from_braille
• Input / output: string → string
• Arguments: none

From Case Insensitive Regex

Converts a case-insensitive regex string to a case sensitive regex string (no guarantee on it being the proper original casing) in case the i flag wasn’t available at the time but now is, or you need it to be case-sensitive again.e.g. [mM][oO][zZ][iI][lL][lL][aA]/[0-9].[0-9] .* becomes Mozilla/[0-9].[0-9] .*

• Tool name: cyberchef_from_case_insensitive_regex
• Input / output: string → string
• Arguments: none

From Charcode

Converts unicode character codes back into text.e.g. 0393 03b5 03b9 03ac 20 03c3 03bf 03c5 becomes Γειά σου

• Tool name: cyberchef_from_charcode
• Input / output: string → ArrayBuffer

Argument	Type	Default
delimiter	option	Space
base	number	16

From COBS

Decodes COBS encoded bytes

• Tool name: cyberchef_from_cobs
• Input / output: byteArray → byteArray
• Arguments: none

From Decimal

Converts the data from an ordinal integer array back into its raw form.e.g. 72 101 108 108 111 becomes Hello

• Tool name: cyberchef_from_decimal
• Input / output: string → byteArray

Argument	Type	Default
delimiter	option	Space
support_signed_values	boolean	false

From Float

Convert from IEEE754 Floating Point Numbers

• Tool name: cyberchef_from_float
• Input / output: string → byteArray

Argument	Type	Default
endianness	option	Big Endian
size	option	Float (4 bytes)
delimiter	option	Space

From Hex

Converts a hexadecimal byte string back into its raw value.e.g. ce 93 ce b5 ce b9 ce ac 20 cf 83 ce bf cf 85 0a becomes the UTF-8 encoded string Γειά σου

• Tool name: cyberchef_from_hex
• Input / output: string → byteArray

Argument	Type	Default
delimiter	option	Auto

From Hex Content

Translates hexadecimal bytes in text back to raw bytes. This format is used by SNORT for representing hex within ASCII text.e.g. foo|3d|bar becomes foo=bar.

• Tool name: cyberchef_from_hex_content
• Input / output: string → byteArray
• Arguments: none

From Hexdump

Attempts to convert a hexdump back into raw data. This operation supports many different hexdump variations, but probably not all. Make sure you verify that the data it gives you is correct before continuing analysis.

• Tool name: cyberchef_from_hexdump
• Input / output: string → byteArray
• Arguments: none

From Modhex

Converts a modhex byte string back into its raw value.

• Tool name: cyberchef_from_modhex
• Input / output: string → byteArray

Argument	Type	Default
delimiter	option	Auto

From Morse Code

Translates Morse Code into (upper case) alphanumeric characters.

• Tool name: cyberchef_from_morse_code
• Input / output: string → string

Argument	Type	Default
letter_delimiter	option	Space
word_delimiter	option	Line feed

From Octal

Converts an octal byte string back into its raw value.e.g. 316 223 316 265 316 271 316 254 40 317 203 316 277 317 205 becomes the UTF-8 encoded string Γειά σου

• Tool name: cyberchef_from_octal
• Input / output: string → byteArray

Argument	Type	Default
delimiter	option	Space

From Quoted Printable

Converts QP-encoded text back to standard text. This format is a content transfer encoding common in email messages.e.g. The quoted-printable encoded string hello=20world becomes hello world

• Tool name: cyberchef_from_quoted_printable
• Input / output: string → byteArray
• Arguments: none

From UNIX Timestamp

Converts a UNIX timestamp to a datetime string.e.g. 978346800 becomes Mon 1 January 2001 11:00:00 UTCA UNIX timestamp is a 32-bit value representing the number of seconds since January 1, 1970 UTC (the UNIX epoch).

• Tool name: cyberchef_from_unix_timestamp
• Input / output: number → string

Argument	Type	Default
units	option	Seconds (s)

Fuzzy Match

Conducts a fuzzy search to find a pattern within the input based on weighted criteria.e.g. A search for dpan will match on Don’t Panic

• Tool name: cyberchef_fuzzy_match
• Input / output: string → html

Argument	Type	Default
search	binaryString	—
sequential_bonus	number	15
separator_bonus	number	30
camel_bonus	number	30
first_letter_bonus	number	15
leading_letter_penalty	number	-5
max_leading_letter_penalty	number	-15
unmatched_letter_penalty	number	-1

Generate De Bruijn Sequence

Generates rolling keycode combinations given a certain alphabet size and key length.

• Tool name: cyberchef_generate_de_bruijn_sequence
• Input / output: string → string

Argument	Type	Default
alphabet_size_k	number	2
key_length_n	number	3

Generate HOTP

The HMAC-based One-Time Password algorithm (HOTP) is an algorithm that computes a one-time password from a shared secret key and an incrementing counter. It has been adopted as Internet Engineering Task Force standard RFC 4226, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems.Enter the secret as the input or leave it blank for a random secret to be generated. The secret must be a valid base32 string (characters A–Z and 2–7).

• Tool name: cyberchef_generate_hotp
• Input / output: ArrayBuffer → string

Argument	Type	Default
name	string	Account
code_length	number	6
counter	number	0

Generate Lorem Ipsum

Generate varying length lorem ipsum placeholder text.

• Tool name: cyberchef_generate_lorem_ipsum
• Input / output: string → string

Argument	Type	Default
length	number	3
length_in	option	Paragraphs

Generate TOTP

The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems. A TOTP is an HOTP where the counter is the current time.Enter the secret as the input or leave it blank for a random secret to be generated. The secret must be a valid base32 string (characters A–Z and 2–7). T0 and T1 are in seconds.

• Tool name: cyberchef_generate_totp
• Input / output: ArrayBuffer → string

Argument	Type	Default
name	string	Account
code_length	number	6
epoch_offset_t0	number	0
interval_t1	number	30

Get All Casings

Outputs all possible casing variations of a string.

• Tool name: cyberchef_get_all_casings
• Input / output: string → string
• Arguments: none

Get Time

Generates a timestamp showing the amount of time since the UNIX epoch (1970-01-01 00:00:00 UTC). Uses the W3C High Resolution Time API.

• Tool name: cyberchef_get_time
• Input / output: string → number

Argument	Type	Default
granularity	option	Seconds (s)

Group IP addresses

Groups a list of IP addresses into subnets. Supports both IPv4 and IPv6 addresses.

• Tool name: cyberchef_group_ip_addresses
• Input / output: string → string

Argument	Type	Default
delimiter	option	Line feed
subnet_cidr	number	24
only_show_the_subnets	boolean	false

Hamming Distance

In information theory, the Hamming distance between two strings of equal length is the number of positions at which the corresponding symbols are different. In other words, it measures the minimum number of substitutions required to change one string into the other, or the minimum number of errors that could have transformed one string into the other. In a more general context, the Hamming distance is one of several string metrics for measuring the edit distance between two sequences.

• Tool name: cyberchef_hamming_distance
• Input / output: string → string

Argument	Type	Default
delimiter	binaryShortString	\n\n
unit	option	Byte
input_type	option	Raw string

Haversine distance

Returns the distance between two pairs of GPS latitude and longitude co-ordinates in metres.e.g. 51.487263,-0.124323, 38.9517,-77.1467

• Tool name: cyberchef_haversine_distance
• Input / output: string → number
• Arguments: none

Head

Like the UNIX head utility.Gets the first n lines.You can select all but the last n lines by entering a negative value for n.The delimiter can be changed so that instead of lines, fields (i.e. commas) are selected instead.

• Tool name: cyberchef_head
• Input / output: string → string

Argument	Type	Default
delimiter	option	Line feed
number	number	10

HTML To Text

Converts an HTML output from an operation to a readable string instead of being rendered in the DOM.

• Tool name: cyberchef_html_to_text
• Input / output: html → string
• Arguments: none

HTTP request

Makes an HTTP request and returns the response. This operation supports different HTTP verbs like GET, POST, PUT, etc. You can add headers line by line in the format Key: Value The status code of the response, along with a limited selection of exposed headers, can be viewed by checking the ‘Show response metadata’ option. Only a limited set of response headers are exposed by the browser for security reasons.

• Tool name: cyberchef_http_request
• Input / output: string → string

Argument	Type	Default
method	option	GET
url	string	—
headers	text	—
mode	option	Cross-Origin Resource Sharing
show_response_metadata	boolean	false

Index of Coincidence

Index of Coincidence (IC) is the probability of two randomly selected characters being the same. This can be used to determine whether text is readable or random, with English text having an IC of around 0.066. IC can therefore be a sound method to automate frequency analysis.

• Tool name: cyberchef_index_of_coincidence
• Input / output: string → html
• Arguments: none

IPv6 Transition Addresses

Converts IPv4 addresses to their IPv6 Transition addresses. IPv6 Transition addresses can also be converted back into their original IPv4 address. MAC addresses can also be converted into the EUI-64 format, this can them be appended to your IPv6 /64 range to obtain a full /128 address.Transition technologies enable translation between IPv4 and IPv6 addresses or tunneling to allow traffic to pass through the incompatible network, allowing the two standards to coexist.Only /24 ranges and currently handled. Remove headers to easily copy out results.

• Tool name: cyberchef_ipv6_transition_addresses
• Input / output: string → string

Argument	Type	Default
ignore_ranges	boolean	true
remove_headers	boolean	false

JSON to CSV

Converts JSON data to a CSV based on the definition in RFC 4180.

• Tool name: cyberchef_json_to_csv
• Input / output: JSON → string

Argument	Type	Default
cell_delimiter	binaryShortString	,
row_delimiter	binaryShortString	\r\n

JSON to YAML

Format a JSON object into YAML

• Tool name: cyberchef_json_to_yaml
• Input / output: JSON → string
• Arguments: none

Jump

Jump forwards or backwards to the specified Label

• Tool name: cyberchef_jump
• Input / output: string → string
• Flow control: yes

Argument	Type	Default
label_name	string	—
maximum_jumps_if_jumping_backwards	number	10

Label

Provides a location for conditional and fixed jumps to redirect execution to.

• Tool name: cyberchef_label
• Input / output: string → string
• Flow control: yes

Argument	Type	Default
name	shortString	—

Levenshtein Distance

Levenshtein Distance (also known as Edit Distance) is a string metric to measure a difference between two strings that counts operations (insertions, deletions, and substitutions) on single character that are required to change one string to another.

• Tool name: cyberchef_levenshtein_distance
• Input / output: string → number

Argument	Type	Default
sample_delimiter	binaryString	\n
insertion_cost	number	1
deletion_cost	number	1
substitution_cost	number	1

Luhn Checksum

The Luhn mod N algorithm using the english alphabet. The Luhn mod N algorithm is an extension to the Luhn algorithm (also known as mod 10 algorithm) that allows it to work with sequences of values in any even-numbered base. This can be useful when a check digit is required to validate an identification string composed of letters, a combination of letters and digits or any arbitrary set of N characters where N is divisible by 2.

• Tool name: cyberchef_luhn_checksum
• Input / output: string → string

Argument	Type	Default
radix	number	10

Magic

The Magic operation attempts to detect various properties of the input data and suggests which operations could help to make more sense of it.OptionsDepth: If an operation appears to match the data, it will be run and the result will be analysed further. This argument controls the maximum number of levels of recursion.Intensive mode: When this is turned on, various operations like XOR, bit rotates, and character encodings are brute-forced to attempt to detect valid data underneath. To improve performance, only the first 100 bytes of the data is brute-forced.Extensive language support: At each stage, the relative byte frequencies of the data will be compared to average frequencies for a number of languages. The default set consists of ~40 of the most commonly used languages on the Internet. The extensive list consists of 284 languages and can result in many languages matching the data if their byte frequencies are similar.Optionally enter a regular expression to match a string you expect to find to filter results (crib).

• Tool name: cyberchef_magic
• Input / output: ArrayBuffer → html
• Flow control: yes

Argument	Type	Default
depth	number	3
intensive_mode	boolean	false
extensive_language_support	boolean	false
crib_known_plaintext_string_or_regex	string	—

Mean

Computes the mean (average) of a number list. If an item in the string is not a number it is excluded from the list.e.g. 0x0a 8 .5 .5 becomes 4.75

• Tool name: cyberchef_mean
• Input / output: string → BigNumber

Argument	Type	Default
delimiter	option	Line feed

Median

Computes the median of a number list. If an item in the string is not a number it is excluded from the list.e.g. 0x0a 8 1 .5 becomes 4.5

• Tool name: cyberchef_median
• Input / output: string → BigNumber

Argument	Type	Default
delimiter	option	Line feed

Merge

Consolidate all branches back into a single trunk. The opposite of Fork. Unticking the Merge All checkbox will only consolidate all branches up to the nearest Fork/Subsection.

• Tool name: cyberchef_merge
• Input / output: string → string
• Flow control: yes

Argument	Type	Default
merge_all	boolean	true

Microsoft Script Decoder

Decodes Microsoft Encoded Script files that have been encoded with Microsoft’s custom encoding. These are often VBS (Visual Basic Script) files that are encoded and renamed with a ‘.vbe’ extention or JS (JScript) files renamed with a ‘.jse’ extention.SampleEncoded:#@^RQAAAA==-mDsX|:/TP{J:+dYbxL@!F@@!+@@!&@*eEI@#@&@#@&.jm.raY 214Wv:zms/obI0xEAAA==^#~@Decoded:var my_msg = "Testing !"; VScript.Echo(my_msg);

• Tool name: cyberchef_microsoft_script_decoder
• Input / output: string → string
• Arguments: none

MIME Decoding

Enables the decoding of MIME message header extensions for non-ASCII text

• Tool name: cyberchef_mime_decoding
• Input / output: byteArray → string
• Arguments: none

MOD

Computes the modulo of each number in a list with a given modulus value. Numbers are extracted from the input based on the delimiter, and non-numeric values are ignored.e.g. 15 4 7 with modulus 3 becomes 0 1 1

• Tool name: cyberchef_mod
• Input / output: string → string

Argument	Type	Default
modulus	number	2
delimiter	option	Line feed

Multiply

Multiplies a list of numbers. If an item in the string is not a number it is excluded from the list.e.g. 0x0a 8 .5 becomes 40

• Tool name: cyberchef_multiply
• Input / output: string → BigNumber

Argument	Type	Default
delimiter	option	Line feed

NOT

Returns the inverse of each byte.

• Tool name: cyberchef_not
• Input / output: ArrayBuffer → byteArray
• Arguments: none

Numberwang

Based on the popular gameshow by Mitchell and Webb.

• Tool name: cyberchef_numberwang
• Input / output: string → string
• Arguments: none

Offset checker

Compares multiple inputs (separated by the specified delimiter) and highlights matching characters which appear at the same position in all samples.

• Tool name: cyberchef_offset_checker
• Input / output: string → html

Argument	Type	Default
sample_delimiter	binaryString	\n\n

OR

OR the input with the given key.e.g. fe023da5

• Tool name: cyberchef_or
• Input / output: ArrayBuffer → byteArray

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}

P-list Viewer

In the macOS, iOS, NeXTSTEP, and GNUstep programming frameworks, property list files are files that store serialized objects. Property list files use the filename extension .plist, and thus are often referred to as p-list files.This operation displays plist files in a human readable format.

• Tool name: cyberchef_p_list_viewer
• Input / output: string → string
• Arguments: none

Pad lines

Add the specified number of the specified character to the beginning or end of each line

• Tool name: cyberchef_pad_lines
• Input / output: string → string

Argument	Type	Default
position	option	Start
length	number	5
character	binaryShortString	``

Parity Bit

A parity bit, or check bit, is the simplest form of error detection. It is a bit which is added to a string of bits and represents if the number of 1’s in the binary string is an even number or odd number.If a delimiter is specified, the parity bit calculation will be performed on each ‘block’ of the input data, where the blocks are created by slicing the input at each occurrence of the delimiter character

• Tool name: cyberchef_parity_bit
• Input / output: string → string

Argument	Type	Default
mode	option	Even Parity
postion	option	Start
encode_or_decode	option	Encode
delimiter	shortString	—

Parse colour code

Converts a colour code in a standard format to other standard formats and displays the colour itself.Example inputs#d9edf7rgba(217,237,247,1)hsla(200,65%,91%,1)cmyk(0.12, 0.04, 0.00, 0.03)

• Tool name: cyberchef_parse_colour_code
• Input / output: string → html
• Arguments: none

Parse DateTime

Parses a DateTime string in your specified format and displays it in whichever timezone you choose with the following information:DateTimePeriod (AM/PM)TimezoneUTC offsetDaylight Saving TimeLeap yearDays in this monthDay of yearWeek numberQuarterRun with no input to see format string examples if required.

• Tool name: cyberchef_parse_datetime
• Input / output: string → html

Argument	Type	Default
built_in_formats	populateOption	DD/MM/YYYY HH:mm:ss
input_format_string	binaryString	DD/MM/YYYY HH:mm:ss
input_timezone	option	UTC

Parse Ethernet frame

Parses an Ethernet frame and either shows the deduced values (Source and destination MAC, VLANs) or returns the packet data.Good for use in conjunction with the Parse IPv4, and Parse TCP/UDP recipes.

• Tool name: cyberchef_parse_ethernet_frame
• Input / output: string → html

Argument	Type	Default
input_type	option	Raw
return_type	option	Text output

Parse IP range

Given a CIDR range (e.g. 10.0.0.0/24), hyphenated range (e.g. 10.0.0.0 - 10.0.1.0), or a list of IPs and/or CIDR ranges (separated by a new line), this operation provides network information and enumerates all IP addresses in the range.IPv6 is supported but will not be enumerated.

• Tool name: cyberchef_parse_ip_range
• Input / output: string → string

Argument	Type	Default
include_network_info	boolean	true
enumerate_ip_addresses	boolean	true
allow_large_queries	boolean	false

Parse IPv4 header

Given an IPv4 header, this operations parses and displays each field in an easily readable format.

• Tool name: cyberchef_parse_ipv4_header
• Input / output: string → html

Argument	Type	Default
input_format	option	Hex
output_format	option	Table

Parse IPv6 address

Displays the longhand and shorthand versions of a valid IPv6 address.Recognises all reserved ranges and parses encapsulated or tunnelled addresses including Teredo and 6to4.

• Tool name: cyberchef_parse_ipv6_address
• Input / output: string → string
• Arguments: none

Parse SSH Host Key

Parses a SSH host key and extracts fields from it.The key type can be:ssh-rsassh-dssecdsa-sha2ssh-ed25519The key format can be either Hex or Base64.

• Tool name: cyberchef_parse_ssh_host_key
• Input / output: string → string

Argument	Type	Default
input_format	option	Auto

Parse TCP

Parses a TCP header and payload (if present).

• Tool name: cyberchef_parse_tcp
• Input / output: string → html

Argument	Type	Default
input_format	option	Hex

Parse TLS record

Parses one or more TLS records

• Tool name: cyberchef_parse_tls_record
• Input / output: ArrayBuffer → html
• Arguments: none

Parse TLV

Converts a Type-Length-Value (TLV) encoded string into a JSON object. Can optionally include a Key / Type entry. Tags: Key-Length-Value, KLV, Length-Value, LV

• Tool name: cyberchef_parse_tlv
• Input / output: ArrayBuffer → JSON

Argument	Type	Default
type_key_size	number	1
length_size	number	1
use_ber	boolean	false

Parse UDP

Parses a UDP header and payload (if present).

• Tool name: cyberchef_parse_udp
• Input / output: string → html

Argument	Type	Default
input_format	option	Hex

Parse UNIX file permissions

Given a UNIX/Linux file permission string in octal or textual format, this operation explains which permissions are granted to which user groups.Input should be in either octal (e.g. 755) or textual (e.g. drwxr-xr-x) format.

• Tool name: cyberchef_parse_unix_file_permissions
• Input / output: string → string
• Arguments: none

PEM to Hex

Converts PEM (Privacy Enhanced Mail) format to a hexadecimal DER (Distinguished Encoding Rules) string.

• Tool name: cyberchef_pem_to_hex
• Input / output: string → string
• Arguments: none

PHP Deserialize

Deserializes PHP serialized data, outputting keyed arrays as JSON.This function does not support object tags.Example:a:2:{s:1:"a";i:10;i:0;a:1:{s:2:"ab";b:1;}}becomes{"a": 10,0: {"ab": true}}Output valid JSON: JSON doesn’t support integers as keys, whereas PHP serialization does. Enabling this will cast these integers to strings. This will also escape backslashes.

• Tool name: cyberchef_php_deserialize
• Input / output: string → string

Argument	Type	Default
output_valid_json	boolean	true

PHP Serialize

Performs PHP serialization on JSON data.This function does not support object tags.Since PHP doesn’t distinguish dicts and arrays, this operation is not always symmetric to PHP Deserialize.Example:[5,"abc",true]becomesa:3:{i:0;i:5;i:1;s:3:"abc";i:2;b:1;}

• Tool name: cyberchef_php_serialize
• Input / output: JSON → string
• Arguments: none

Play Media

Plays the input as audio or video depending on the type.Tags: sound, movie, mp3, mp4, mov, webm, wav, ogg

• Tool name: cyberchef_play_media
• Input / output: string → html

Argument	Type	Default
input_format	option	Raw

Power Set

Calculates all the subsets of a set.

• Tool name: cyberchef_power_set
• Input / output: string → string

Argument	Type	Default
item_delimiter	binaryString	,

RAKE

Rapid Keyword Extraction (RAKE) RAKE is a domain-independent keyword extraction algorithm in Natural Language Processing. The list of stop words are from the NLTK python package

• Tool name: cyberchef_rake
• Input / output: string → string

Argument	Type	Default
word_delimiter_regex	text	\s
sentence_delimiter_regex	text	`.\s
stop_words	text	i,me,my,myself,we,our,ours,ourselves,you,you're,

Remove ANSI Escape Codes

Removes ANSI Escape Codes.

• Tool name: cyberchef_remove_ansi_escape_codes
• Input / output: string → string
• Arguments: none

Remove Diacritics

Replaces accented characters with their latin character equivalent. Accented characters are made up of Unicode combining characters, so unicode text formatting such as strikethroughs and underlines will also be removed.

• Tool name: cyberchef_remove_diacritics
• Input / output: string → string
• Arguments: none

Remove line numbers

Removes line numbers from the output if they can be trivially detected.

• Tool name: cyberchef_remove_line_numbers
• Input / output: string → string
• Arguments: none

Remove null bytes

Removes all null bytes (0x00) from the input.

• Tool name: cyberchef_remove_null_bytes
• Input / output: ArrayBuffer → byteArray
• Arguments: none

Remove whitespace

Optionally removes all spaces, carriage returns, line feeds, tabs and form feeds from the input data.This operation also supports the removal of full stops which are sometimes used to represent non-printable bytes in ASCII output.

• Tool name: cyberchef_remove_whitespace
• Input / output: string → string

Argument	Type	Default
spaces	boolean	true
carriage_returns_r	boolean	true
line_feeds_n	boolean	true
tabs	boolean	true
form_feeds_f	boolean	true
full_stops	boolean	false

Return

End execution of operations at this point in the recipe.

• Tool name: cyberchef_return
• Input / output: string → string
• Flow control: yes
• Arguments: none

Reverse

Reverses the input string.

• Tool name: cyberchef_reverse
• Input / output: byteArray → byteArray

Argument	Type	Default
by	option	Character

ROR13

Computes a ROR13 hash used in API hashing techniques.

• Tool name: cyberchef_ror13
• Input / output: byteArray → string
• Arguments: none

ROT13

A simple caesar substitution cipher which rotates alphabet characters by the specified amount (default 13).

• Tool name: cyberchef_rot13
• Input / output: byteArray → byteArray

Argument	Type	Default
rotate_lower_case_chars	boolean	true
rotate_upper_case_chars	boolean	true
rotate_numbers	boolean	false
amount	number	13

ROT13 Brute Force

Try all meaningful amounts for ROT13.Optionally you can enter your known plaintext (crib) to filter the result.

• Tool name: cyberchef_rot13_brute_force
• Input / output: byteArray → string

Argument	Type	Default
rotate_lower_case_chars	boolean	true
rotate_upper_case_chars	boolean	true
rotate_numbers	boolean	false
sample_length	number	100
sample_offset	number	0
print_amount	boolean	true
crib_known_plaintext_string	string	—

ROT47

A slightly more complex variation of a caesar cipher, which includes ASCII characters from 33 ‘!’ to 126 ‘~’. Default rotation: 47.

• Tool name: cyberchef_rot47
• Input / output: byteArray → byteArray

Argument	Type	Default
amount	number	47

ROT47 Brute Force

Try all meaningful amounts for ROT47.Optionally you can enter your known plaintext (crib) to filter the result.

• Tool name: cyberchef_rot47_brute_force
• Input / output: byteArray → string

Argument	Type	Default
sample_length	number	100
sample_offset	number	0
print_amount	boolean	true
crib_known_plaintext_string	string	—

ROT8000

The simple Caesar-cypher encryption that replaces each Unicode character with the one 0x8000 places forward or back along the alphabet.

• Tool name: cyberchef_rot8000
• Input / output: string → string
• Arguments: none

Rotate left

Rotates each byte to the left by the number of bits specified, optionally carrying the excess bits over to the next byte. Currently only supports 8-bit values.

• Tool name: cyberchef_rotate_left
• Input / output: byteArray → byteArray

Argument	Type	Default
amount	number	1
carry_through	boolean	false

Rotate right

Rotates each byte to the right by the number of bits specified, optionally carrying the excess bits over to the next byte. Currently only supports 8-bit values.

• Tool name: cyberchef_rotate_right
• Input / output: byteArray → byteArray

Argument	Type	Default
amount	number	1
carry_through	boolean	false

Scan for Embedded Files

Scans the data for potential embedded files by looking for magic bytes at all offsets. This operation is prone to false positives.WARNING: Files over about 100KB in size will take a VERY long time to process.

• Tool name: cyberchef_scan_for_embedded_files
• Input / output: ArrayBuffer → string

Argument	Type	Default
images	boolean	true
video	boolean	true
audio	boolean	true
documents	boolean	true
applications	boolean	true
archives	boolean	true
miscellaneous	boolean	false

Set Difference

Calculates the difference, or relative complement, of two sets.

• Tool name: cyberchef_set_difference
• Input / output: string → string

Argument	Type	Default
sample_delimiter	binaryString	\n\n
item_delimiter	binaryString	,

Set Intersection

Calculates the intersection of two sets.

• Tool name: cyberchef_set_intersection
• Input / output: string → string

Argument	Type	Default
sample_delimiter	binaryString	\n\n
item_delimiter	binaryString	,

Set Union

Calculates the union of two sets.

• Tool name: cyberchef_set_union
• Input / output: string → string

Argument	Type	Default
sample_delimiter	binaryString	\n\n
item_delimiter	binaryString	,

Show Base64 offsets

When a string is within a block of data and the whole block is Base64’d, the string itself could be represented in Base64 in three distinct ways depending on its offset within the block.This operation shows all possible offsets for a given string so that each possible encoding can be considered.

• Tool name: cyberchef_show_base64_offsets
• Input / output: byteArray → html

Argument	Type	Default
alphabet	binaryString	A-Za-z0-9+/=
show_variable_chars_and_padding	boolean	true
input_format	option	Raw

Shuffle

Randomly reorders input elements.

• Tool name: cyberchef_shuffle
• Input / output: string → string

Argument	Type	Default
delimiter	option	Line feed

Sleep

Sleep causes the recipe to wait for a specified number of milliseconds before continuing execution.

• Tool name: cyberchef_sleep
• Input / output: ArrayBuffer → ArrayBuffer

Argument	Type	Default
time_ms	number	1000

Sort

Alphabetically sorts strings separated by the specified delimiter.The IP address option supports IPv4 only.

• Tool name: cyberchef_sort
• Input / output: string → string

Argument	Type	Default
delimiter	option	Line feed
reverse	boolean	false
order	option	Alphabetical (case sensitive)

Split

Splits a string into sections around a given delimiter.

• Tool name: cyberchef_split
• Input / output: string → string

Argument	Type	Default
split_delimiter	editableOptionShort	,
join_delimiter	editableOptionShort	\n

Standard Deviation

Computes the standard deviation of a number list. If an item in the string is not a number it is excluded from the list.e.g. 0x0a 8 .5 becomes 4.089281382128433

• Tool name: cyberchef_standard_deviation
• Input / output: string → BigNumber

Argument	Type	Default
delimiter	option	Line feed

Strip HTML tags

Removes all HTML tags from the input.

• Tool name: cyberchef_strip_html_tags
• Input / output: string → string

Argument	Type	Default
remove_indentation	boolean	true
remove_excess_line_breaks	boolean	true

Strip HTTP headers

Removes HTTP headers from a request or response by looking for the first instance of a double newline.

• Tool name: cyberchef_strip_http_headers
• Input / output: string → string
• Arguments: none

Strip IPv4 header

Strips the IPv4 header from an IPv4 packet, outputting the payload.

• Tool name: cyberchef_strip_ipv4_header
• Input / output: ArrayBuffer → ArrayBuffer
• Arguments: none

Strip TCP header

Strips the TCP header from a TCP segment, outputting the payload.

• Tool name: cyberchef_strip_tcp_header
• Input / output: ArrayBuffer → ArrayBuffer
• Arguments: none

Strip UDP header

Strips the UDP header from a UDP datagram, outputting the payload.

• Tool name: cyberchef_strip_udp_header
• Input / output: ArrayBuffer → ArrayBuffer
• Arguments: none

SUB

SUB the input with the given key (e.g. fe023da5), MOD 255

• Tool name: cyberchef_sub
• Input / output: byteArray → byteArray

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}

Subsection

Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there’s more than one capture group, only the first one will be operated on.Use the Merge operation to reset the effects of subsection.

• Tool name: cyberchef_subsection
• Input / output: string → string
• Flow control: yes

Argument	Type	Default
section_regex	string	—
case_sensitive_matching	boolean	true
global_matching	boolean	true
ignore_errors	boolean	false

Substitute

A substitution cipher allowing you to specify bytes to replace with other byte values. This can be used to create Caesar ciphers but is more powerful as any byte value can be substituted, not just letters, and the substitution values need not be in order.Enter the bytes you want to replace in the Plaintext field and the bytes to replace them with in the Ciphertext field.Non-printable bytes can be specified using string escape notation. For example, a line feed character can be written as either \n or \x0a.Byte ranges can be specified using a hyphen. For example, the sequence 0123456789 can be written as 0-9.Note that blackslash characters are used to escape special characters, so will need to be escaped themselves if you want to use them on their own (e.g.\).

• Tool name: cyberchef_substitute
• Input / output: string → string

Argument	Type	Default
plaintext	binaryString	ABCDEFGHIJKLMNOPQRSTUVWXYZ
ciphertext	binaryString	XYZABCDEFGHIJKLMNOPQRSTUVW
ignore_case	boolean	false

Subtract

Subtracts a list of numbers. If an item in the string is not a number it is excluded from the list.e.g. 0x0a 8 .5 becomes 1.5

• Tool name: cyberchef_subtract
• Input / output: string → BigNumber

Argument	Type	Default
delimiter	option	Line feed

Sum

Adds together a list of numbers. If an item in the string is not a number it is excluded from the list.e.g. 0x0a 8 .5 becomes 18.5

• Tool name: cyberchef_sum
• Input / output: string → BigNumber

Argument	Type	Default
delimiter	option	Line feed

Swap case

Converts uppercase letters to lowercase ones, and lowercase ones to uppercase ones.

• Tool name: cyberchef_swap_case
• Input / output: string → string
• Arguments: none

Swap endianness

Switches the data from big-endian to little-endian or vice-versa. Data can be read in as hexadecimal or raw bytes. It will be returned in the same format as it is entered.

• Tool name: cyberchef_swap_endianness
• Input / output: string → string

Argument	Type	Default
data_format	option	Hex
word_length_bytes	number	4
pad_incomplete_words	boolean	true

Symmetric Difference

Calculates the symmetric difference of two sets.

• Tool name: cyberchef_symmetric_difference
• Input / output: string → string

Argument	Type	Default
sample_delimiter	binaryString	\n\n
item_delimiter	binaryString	,

Tail

Like the UNIX tail utility.Gets the last n lines.Optionally you can select all lines after line n by entering a negative value for n.The delimiter can be changed so that instead of lines, fields (i.e. commas) are selected instead.

• Tool name: cyberchef_tail
• Input / output: string → string

Argument	Type	Default
delimiter	option	Line feed
number	number	10

Take bytes

Takes a slice of the specified number of bytes from the data. Negative values are allowed.

• Tool name: cyberchef_take_bytes
• Input / output: ArrayBuffer → ArrayBuffer

Argument	Type	Default
start	number	0
length	number	5
apply_to_each_line	boolean	false

Take nth bytes

Takes every nth byte starting with a given byte.

• Tool name: cyberchef_take_nth_bytes
• Input / output: byteArray → byteArray

Argument	Type	Default
take_every	number	4
starting_at	number	0
apply_to_each_line	boolean	false

Text-Integer Conversion

Converts between text strings and large integers (decimal or hexadecimal).Text is interpreted as a big-endian sequence of character codes. For example:ABC is 0x414243 (hex) is 4276803 (decimal)Input format detection:Decimal: digits 0-9 onlyHexadecimal: 0x… prefixQuoted or unquoted text: treated as stringCharacter limitations:Text input may only contain ASCII and Latin-1 characters (code point Multi-byte Unicode characters will generate an error..

• Tool name: cyberchef_text_integer_conversion
• Input / output: string → string

Argument	Type	Default
output_format	option	String

To Base

Converts a decimal number to a given numerical base.

• Tool name: cyberchef_to_base
• Input / output: BigNumber → string

Argument	Type	Default
radix	number	36

To Base32

Base32 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers. It uses a smaller set of characters than Base64, usually the uppercase alphabet and the numbers 2 to 7.

• Tool name: cyberchef_to_base32
• Input / output: ArrayBuffer → string

Argument	Type	Default
alphabet	editableOption	A-Z2-7=

To Base45

Base45 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers. The high number base results in shorter strings than with the decimal or hexadecimal system. Base45 is optimized for usage with QR codes.

• Tool name: cyberchef_to_base45
• Input / output: ArrayBuffer → string

Argument	Type	Default
alphabet	string	0-9A-Z $%*+\-./:

To Base58

Base58 (similar to Base64) is a notation for encoding arbitrary byte data. It differs from Base64 by removing easily misread characters (i.e. l, I, 0 and O) to improve human readability.This operation encodes data in an ASCII string (with an alphabet of your choosing, presets included).e.g. hello world becomes StV1DL6CwTryKyVBase58 is commonly used in cryptocurrencies (Bitcoin, Ripple, etc).

• Tool name: cyberchef_to_base58
• Input / output: ArrayBuffer → string

Argument	Type	Default
alphabet	editableOption	123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnop

To Base62

Base62 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers. The high number base results in shorter strings than with the decimal or hexadecimal system.

• Tool name: cyberchef_to_base62
• Input / output: ArrayBuffer → string

Argument	Type	Default
alphabet	string	0-9A-Za-z

To Base64

Base64 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers.This operation encodes raw data into an ASCII Base64 string.e.g. hello becomes aGVsbG8=

• Tool name: cyberchef_to_base64
• Input / output: ArrayBuffer → string

Argument	Type	Default
alphabet	editableOption	A-Za-z0-9+/=

To Base85

Base85 (also called Ascii85) is a notation for encoding arbitrary byte data. It is usually more efficient that Base64.This operation encodes data in an ASCII string (with an alphabet of your choosing, presets included).e.g. hello world becomes BOu!rD]j7BEbo7Base85 is commonly used in Adobe’s PostScript and PDF file formats.OptionsAlphabetStandard - The standard alphabet, referred to as Ascii85Z85 (ZeroMQ) - A string-safe variant of Base85, which avoids quote marks and backslash charactersIPv6 - A variant of Base85 suitable for encoding IPv6 addresses (RFC 1924)Include delimiterAdds a ‘’ delimiter to the start and end of the data. This is standard for Adobe’s implementation of Base85.

• Tool name: cyberchef_to_base85
• Input / output: ArrayBuffer → string

Argument	Type	Default
alphabet	editableOption	!-u
include_delimiter	boolean	false

To Base92

Base92 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers.

• Tool name: cyberchef_to_base92
• Input / output: string → byteArray
• Arguments: none

To BCD

Binary-Coded Decimal (BCD) is a class of binary encodings of decimal numbers where each decimal digit is represented by a fixed number of bits, usually four or eight. Special bit patterns are sometimes used for a sign

• Tool name: cyberchef_to_bcd
• Input / output: BigNumber → string

Argument	Type	Default
scheme	option	8 4 2 1
packed	boolean	true
signed	boolean	false
output_format	option	Nibbles

To Bech32

Bech32 is an encoding scheme primarily used for Bitcoin SegWit addresses (BIP-0173). It uses a 32-character alphabet that excludes easily confused characters (1, b, i, o) and includes a checksum for error detection.Bech32m (BIP-0350) is an updated version that fixes a weakness in the original Bech32 checksum and is used for Bitcoin Taproot addresses.The Human-Readable Part (HRP) identifies the network or purpose (e.g., ‘bc’ for Bitcoin mainnet, ‘tb’ for testnet, ‘age’ for AGE encryption keys).Maximum output length is 90 characters as per specification.

• Tool name: cyberchef_to_bech32
• Input / output: ArrayBuffer → string

Argument	Type	Default
human_readable_part_hrp	string	bc
encoding	option	Bech32
input_format	option	Raw bytes
mode	option	Generic
witness_version	number	0

To Binary

Displays the input data as a binary string.e.g. Hi becomes 01001000 01101001

• Tool name: cyberchef_to_binary
• Input / output: ArrayBuffer → string

Argument	Type	Default
delimiter	option	Space
byte_length	number	8

To Braille

Converts text to six-dot braille symbols.

• Tool name: cyberchef_to_braille
• Input / output: string → string
• Arguments: none

To Case Insensitive Regex

Converts a case-sensitive regex string into a case-insensitive regex string in case the i flag is unavailable to you.e.g. Mozilla/[0-9].[0-9] .* becomes [mM][oO][zZ][iI][lL][lL][aA]/[0-9].[0-9] .*

• Tool name: cyberchef_to_case_insensitive_regex
• Input / output: string → string
• Arguments: none

To Charcode

Converts text to its unicode character code equivalent.e.g. Γειά σου becomes 0393 03b5 03b9 03ac 20 03c3 03bf 03c5

• Tool name: cyberchef_to_charcode
• Input / output: string → string

Argument	Type	Default
delimiter	option	Space
base	number	16

To COBS

Encodes bytes in COBS format

• Tool name: cyberchef_to_cobs
• Input / output: byteArray → byteArray
• Arguments: none

To Decimal

Converts the input data to an ordinal integer array.e.g. Hello becomes 72 101 108 108 111

• Tool name: cyberchef_to_decimal
• Input / output: ArrayBuffer → string

Argument	Type	Default
delimiter	option	Space
support_signed_values	boolean	false

To Float

Convert to IEEE754 Floating Point Numbers

• Tool name: cyberchef_to_float
• Input / output: byteArray → string

Argument	Type	Default
endianness	option	Big Endian
size	option	Float (4 bytes)
delimiter	option	Space

To Hex

Converts the input string to hexadecimal bytes separated by the specified delimiter.e.g. The UTF-8 encoded string Γειά σου becomes ce 93 ce b5 ce b9 ce ac 20 cf 83 ce bf cf 85 0a

• Tool name: cyberchef_to_hex
• Input / output: ArrayBuffer → string

Argument	Type	Default
delimiter	option	Space
bytes_per_line	number	0

To Hex Content

Converts special characters in a string to hexadecimal. This format is used by SNORT for representing hex within ASCII text.e.g. foo=bar becomes foo|3d|bar.

• Tool name: cyberchef_to_hex_content
• Input / output: ArrayBuffer → string

Argument	Type	Default
convert	option	Only special chars
print_spaces_between_bytes	boolean	false

To Hexdump

Creates a hexdump of the input data, displaying both the hexadecimal values of each byte and an ASCII representation alongside.The ‘UNIX format’ argument defines which subset of printable characters are displayed in the preview column.

• Tool name: cyberchef_to_hexdump
• Input / output: ArrayBuffer → string

Argument	Type	Default
width	number	16
upper_case_hex	boolean	false
include_final_length	boolean	false
unix_format	boolean	false

To Lower case

Converts every character in the input to lower case.

• Tool name: cyberchef_to_lower_case
• Input / output: string → string
• Arguments: none

To Modhex

Converts the input string to modhex bytes separated by the specified delimiter.

• Tool name: cyberchef_to_modhex
• Input / output: ArrayBuffer → string

Argument	Type	Default
delimiter	option	Space
bytes_per_line	number	0

To Morse Code

Translates alphanumeric characters into International Morse Code.Ignores non-Morse characters.e.g. SOS becomes … — …

• Tool name: cyberchef_to_morse_code
• Input / output: string → string

Argument	Type	Default
format_options	option	-/.
letter_delimiter	option	Space
word_delimiter	option	Line feed

To Octal

Converts the input string to octal bytes separated by the specified delimiter.e.g. The UTF-8 encoded string Γειά σου becomes 316 223 316 265 316 271 316 254 40 317 203 316 277 317 205

• Tool name: cyberchef_to_octal
• Input / output: byteArray → string

Argument	Type	Default
delimiter	option	Space

To Quoted Printable

Quoted-Printable, or QP encoding, is an encoding using printable ASCII characters (alphanumeric and the equals sign ‘=’) to transmit 8-bit data over a 7-bit data path or, generally, over a medium which is not 8-bit clean. It is defined as a MIME content transfer encoding for use in email.QP works by using the equals sign ‘=’ as an escape character. It also limits line length to 76, as some software has limits on line length.

• Tool name: cyberchef_to_quoted_printable
• Input / output: ArrayBuffer → string
• Arguments: none

To Table

Data can be split on different characters and rendered as an HTML, ASCII or Markdown table with an optional header row.Supports the CSV (Comma Separated Values) file format by default. Change the cell delimiter argument to \t to support TSV (Tab Separated Values) or | for PSV (Pipe Separated Values).You can enter as many delimiters as you like. Each character will be treat as a separate possible delimiter.

• Tool name: cyberchef_to_table
• Input / output: string → html

Argument	Type	Default
cell_delimiters	binaryShortString	,
row_delimiters	binaryShortString	\r\n
make_first_row_header	boolean	false
format	option	ASCII

To UNIX Timestamp

Parses a datetime string in UTC and returns the corresponding UNIX timestamp.e.g. Mon 1 January 2001 11:00:00 becomes 978346800A UNIX timestamp is a 32-bit value representing the number of seconds since January 1, 1970 UTC (the UNIX epoch).

• Tool name: cyberchef_to_unix_timestamp
• Input / output: string → string

Argument	Type	Default
units	option	Seconds (s)
treat_as_utc	boolean	true
show_parsed_datetime	boolean	true

To Upper case

Converts the input string to upper case, optionally limiting scope to only the first character in each word, sentence or paragraph.

• Tool name: cyberchef_to_upper_case
• Input / output: string → string

Argument	Type	Default
scope	option	All

Translate DateTime Format

Parses a datetime string in one format and re-writes it in another.Run with no input to see the relevant format string examples.

• Tool name: cyberchef_translate_datetime_format
• Input / output: string → html

Argument	Type	Default
built_in_formats	populateOption	DD/MM/YYYY HH:mm:ss
input_format_string	binaryString	DD/MM/YYYY HH:mm:ss
input_timezone	option	UTC
output_format_string	binaryString	dddd Do MMMM YYYY HH:mm:ss Z z
output_timezone	option	UTC

Unescape string

Unescapes characters in a string that have been escaped. For example, Don't stop me now becomes Don’t stop me now.Supports the following escape sequences:\n (Line feed/newline)\r (Carriage return)\t (Horizontal tab)\b (Backspace)\f (Form feed)\nnn (Octal, where n is 0-7)\xnn (Hex, where n is 0-f)\ (Backslash)' (Single quote)" (Double quote)\unnnn (Unicode character)\u{nnnnnn} (Unicode code point)

• Tool name: cyberchef_unescape_string
• Input / output: string → string
• Arguments: none

Unescape Unicode Characters

Converts unicode-escaped character notation back into raw characters.Supports the prefixes:\u%uU+e.g. \u03c3\u03bf\u03c5 becomes σου

• Tool name: cyberchef_unescape_unicode_characters
• Input / output: string → string

Argument	Type	Default
prefix	option	\u

Unicode Text Format

Adds Unicode combining characters to change formatting of plaintext.

• Tool name: cyberchef_unicode_text_format
• Input / output: byteArray → byteArray

Argument	Type	Default
underline	boolean	false
strikethrough	boolean	false

Unique

Removes duplicate strings from the input.

• Tool name: cyberchef_unique
• Input / output: string → string

Argument	Type	Default
delimiter	option	Line feed
display_count	boolean	false

UNIX Timestamp to Windows Filetime

Converts a UNIX timestamp to a Windows Filetime value.A Windows Filetime is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 UTC.A UNIX timestamp is a 32-bit value representing the number of seconds since January 1, 1970 UTC (the UNIX epoch).This operation also supports UNIX timestamps in milliseconds, microseconds and nanoseconds.

• Tool name: cyberchef_unix_timestamp_to_windows_filetime
• Input / output: string → string

Argument	Type	Default
input_units	option	Seconds (s)
output_format	option	Decimal

VarInt Decode

Decodes a VarInt encoded integer. VarInt is an efficient way of encoding variable length integers and is commonly used with Protobuf.

• Tool name: cyberchef_varint_decode
• Input / output: byteArray → string
• Arguments: none

VarInt Encode

Encodes a Vn integer as a VarInt. VarInt is an efficient way of encoding variable length integers and is commonly used with Protobuf.

• Tool name: cyberchef_varint_encode
• Input / output: string → byteArray
• Arguments: none

Windows Filetime to UNIX Timestamp

Converts a Windows Filetime value to a UNIX timestamp.A Windows Filetime is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 UTC.A UNIX timestamp is a 32-bit value representing the number of seconds since January 1, 1970 UTC (the UNIX epoch).This operation also supports UNIX timestamps in milliseconds, microseconds and nanoseconds.

• Tool name: cyberchef_windows_filetime_to_unix_timestamp
• Input / output: string → string

Argument	Type	Default
output_units	option	Seconds (s)
input_format	option	Decimal

Wrap

Wraps the input text at a specified number of characters per line.

• Tool name: cyberchef_wrap
• Input / output: string → string

Argument	Type	Default
line_width	number	64

XKCD Random Number

RFC 1149.5 specifies 4 as the standard IEEE-vetted random number.

• Tool name: cyberchef_xkcd_random_number
• Input / output: string → number
• Arguments: none

XOR

XOR the input with the given key.e.g. fe023da5OptionsNull preserving: If the current byte is 0x00 or the same as the key, skip it.Scheme:Standard - key is unchanged after each roundInput differential - key is set to the value of the previous unprocessed byteOutput differential - key is set to the value of the previous processed byteCascade - key is set to the input byte shifted by one

• Tool name: cyberchef_xor
• Input / output: ArrayBuffer → byteArray

Argument	Type	Default
key	toggleString	{"option":"Hex","string":""}
scheme	option	Standard
null_preserving	boolean	false

XOR Brute Force

Enumerate all possible XOR solutions. Current maximum key length is 2 due to browser performance.Optionally enter a string that you expect to find in the plaintext to filter results (crib).

• Tool name: cyberchef_xor_brute_force
• Input / output: ArrayBuffer → string

Argument	Type	Default
key_length	number	1
sample_length	number	100
sample_offset	number	0
scheme	option	Standard
null_preserving	boolean	false
print_key	boolean	true
output_as_hex	boolean	false
crib_known_plaintext_string	binaryString	—

YAML to JSON

Convert YAML to JSON

• Tool name: cyberchef_yaml_to_json
• Input / output: string → JSON
• Arguments: none