CyberChef: the swiss army knife for decoding anything

why your browser history is full of mystery strings

you ever open a log file or an email header and see a chunk of text that looks like someone fell asleep on their keyboard. stuff like aGVsbG8gd29ybGQ= sitting in a url parameter or a phishing email's attachment name. that's usually just encoded data, not some secret hacker code. the tool analysts reach for to make sense of it is cyberchef, and it's free, it's local, and honestly it should be on every defender's bookmarks bar right next to your password manager.

what cyberchef actually is

cyberchef is a web based tool built by gchq (yes, the uk intelligence agency, they open sourced it) that lets you decode, encode, hash, defang, and generally untangle weird data without writing a single script. you drag "recipes" together, like lego blocks, and it transforms whatever text or file you drop in. the big thing for defenders is that it runs entirely in your browser. you can download it and open it with no internet connection at all. nothing you paste into it ever leaves your machine.

from base64, the command that started this post

base64 is one of the most common encodings you'll run into during an investigation. it's not encryption, it's just a way to represent binary data as readable text, which makes it perfect for sneaking payloads into places like email attachments, powershell commands, or malicious urls. if you've ever seen a powershell log with -enc followed by a long garbled string, that's base64.

here's the basic move in cyberchef:

1. paste the suspicious string into the input box
2. drag "from base64" into the recipe area
3. read the decoded output on the right

that's it. no terminal, no third party decoder site that logs what you paste (looking at you, random "base64 decoder" websites). if the decoded output is itself encoded again, like base64 inside base64 inside gzip, you just stack more recipe blocks until it's readable. this is normal with obfuscated malware strings, they often wrap themselves in multiple layers hoping an analyst gives up after step one.

defang url, for when you need to share evidence safely

say you find a phishing link in an email and you want to send it to your team or post it in a writeup. if you paste a live clickable link into slack or a document, someone's email client or link preview bot might actually visit it. defanging breaks the link so it can't be accidentally clicked or auto fetched, turning http://badsite.com into something like hxxp[://]badsite[.]com. cyberchef does this instantly with the "defang url" recipe, which beats manually typing out brackets every time you report an incident.

magic, the "just figure it out for me" button

sometimes you genuinely don't know what encoding you're looking at. that's where the "magic" operation comes in. drop it on top of your input and cyberchef will guess, trying base64, hex, rot13, gzip, and a pile of other common encodings, then score how "readable" the output looks. it's not perfect but it's a fantastic starting point when you're staring at a string at 2am during an incident and don't want to manually test ten different decoders.

how this protects you as a defender

the whole point of a tool like this is giving you visibility into what's actually happening on your own systems instead of trusting a black box website to tell you. use it to inspect suspicious email headers, check what a weird url parameter actually contains, decode payloads found in logs, or sanity check anything that looks obfuscated before you decide if it's dangerous. because it runs locally, you're not handing potentially sensitive data, like your own company's logs or a client's incident artifacts, over to some random third party server. that matters a lot if you work under an nda or handle regulated data.

the takeaway

cyberchef isn't flashy, it's just useful, which honestly describes most of the best security tools. grab it, run it locally, and spend twenty minutes decoding random stuff you find in your own logs just to get comfortable with the interface before you actually need it during an incident. the time to learn a tool is never during the fire.