CyberChef
GCHQ · CyberChef 11 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A browser-based tool published by GCHQ that chains together hundreds of data operations — encodings, ciphers, compression, hashing, timestamp conversion, parsing, and extraction — into a visible recipe. It runs entirely client-side and is actively released.
Who it is for, and when
CyberChef is the everyday solvent for encoded data in forensic work: base64 inside a registry value, a gzipped blob in a log, a Windows FILETIME that needs converting, a URL-encoded parameter, an obfuscated PowerShell command line. Its real advantage for expert work is that the recipe is an explicit, reproducible list of transformations you can paste into a report so anyone can repeat the step and get the same output. It is also a fast way to test a hypothesis about what an unknown blob is.
What it does not cover
CyberChef transforms data you already have; it acquires nothing, parses no artefact formats, and keeps no case record. Although it runs locally in the browser, treat the hosted instance with care and use a local copy for sensitive material. It is not a cryptanalysis tool — it applies operations you specify and will not break modern encryption.
Go to the source
Open at gchq.github.io (opens in a new tab)https://gchq.github.io/CyberChef/
Details
- Type
- Tool
- Written for
- New to the fieldWorking examinerNew to the field, Working examiner
- Publisher
- GCHQ
- Version verified
- CyberChef 11
- Year
- 2026
- Topics
- encryption, malware, triage, open-source, scripting
- Checked at source
Related entries
Ghidra
FreeAn open-source software reverse engineering framework released by the NSA, with a disassembler, a decompiler producing C-like output, scripting in Java and Python, and support for many processor architectures. The former ghidra-sre.org address now redirects to the GitHub project.
Two closely related open-source reverse engineering frameworks. radare2 is the original Unix-style command-line toolkit for binary analysis, patching, and debugging; Rizin is a fork of radare2 that set out to stabilise the API and command set and ships the Cutter GUI. Both are actively developed and release regularly.
RegRipper
FreeAn open-source Perl tool that runs a library of plugins against Windows registry hives and reports the values that matter forensically, with each plugin documenting the key it read. RegRipper 3.0 is the current line and the repository remains actively updated.
Velociraptor
FreeAn open-source endpoint visibility and DFIR platform built around VQL, a query language for collecting artefacts, monitoring events, and hunting across a fleet of agents. Development is sponsored by Rapid7, with the code still published under the Velocidex organisation.
YARA and YARA-X
FreeA pattern-matching language and scanner for identifying files by their content — strings, byte sequences, and structural conditions — used to label malware families and find known artefacts at scale. YARA-X is a ground-up rewrite in Rust from the same maintainers and is now the forward direction of the project; the original YARA 4.x line still receives releases and remains widely deployed.