Execute a CyberChef recipe. Use this for complex chains of operations.

Execute multiple CyberChef operations in batch (parallel or sequential mode). Supports partial success.

Clear the operation result cache.

Get cache statistics including hits, misses, size, and items.

List CyberChef's operation categories with counts and examples. Start here to browse what this server can do, then use cyberchef_list_operations.

Get statistics on deprecated API usage in current session. Shows which deprecation warnings have been triggered and v2.0.0 preparation status.

Full argument schema, defaults and types for one or more operations. This is what you need before calling cyberchef_bake with a new operation.

List the operations in one category, with a one-line summary of each. Use cyberchef_describe_operation for full argument schemas.

Analyze recipes and configurations for v2.0.0 compatibility. Returns compatibility issues and optionally transforms recipes to v2.0.0 format.

Get current resource quota information including concurrent operations and data sizes.

Create a new recipe with multiple operations.

Delete a recipe by ID.

Execute a saved recipe with input data.

Export a recipe to various formats (json, yaml, url, cyberchef).

Get a recipe by ID.

Import a recipe from various formats.

List all recipes with optional filtering.

Test a recipe with sample inputs.

Update an existing recipe.

Validate a recipe without saving it.

Search for available CyberChef operations. Returns names and one-line summaries; follow up with cyberchef_describe_operation for argument schemas.

Export collected telemetry metrics. Returns anonymized usage statistics.

Get worker thread pool statistics including thread count, utilization, and completed tasks. Only available when ENABLE_WORKERS=true.

Order a PEM bundle of X.509 certificates into a chain and report where it breaks: wrong order, a missing intermediate, an expired link, an issuer not permitted to sign, or an issuer whose name and key identifier match while its SIGNATURE does not — the shape of a substituted certificate. Every link is verified CRYPTOGRAPHICALLY: matching names and key identifiers are metadata, and anyone can mint a certificate carrying the ones they like. The three X.509 operations each parse ONE certificate and nothing relates two.

Encode and decode the classical ciphers CyberChef has no operation for: Playfair, the Polybius square, ADFGVX and Baudot/ITA2 (tap code is a Polybius square, so it is the same tool). Every contested convention is a parameter, because implementations that disagree on one disagree on every message.

Compute statistics ACROSS a set of samples — what a recipe cannot express, since Fork runs each branch separately and nothing combines them. Infers record structure from per-offset byte AND bit variance, grouping adjacent offsets into fields; finds repeated cipher blocks (ECB and any other diffusion-free mode) and reports WHERE they sit; and finds nonce reuse, emitting the XOR of the two bodies, which is both the evidence and the way in. Assumes fixed-length or left-aligned samples.

Drag a guessed plaintext fragment along a XOR ciphertext and report every offset where it fits, ranked. With TWO ciphertexts under one key their XOR cancels the key, so a crib guessed in one message yields the matching span of the OTHER. With ONE ciphertext and a known fragment it yields key bytes instead; supply key_length and periodicity becomes a far stronger filter than printability, recovering the whole key when the crib is at least as long as it.

Generate a De Bruijn (cyclic) pattern, or find the offset of a fragment within one. Compatible with pwntools' cyclic/cyclic_find, so patterns and offsets are interchangeable with it. Use mode=find with the bytes recovered from a crashed register to get the overflow offset; hex input is interpreted as both big- and little-endian, because a register dump is usually reversed relative to memory.

Recover an ECDSA private key from two signatures that reused a nonce, detected by a shared r. Exact algebra, not a search: k = (z1-z2)/(s1±s2), d = (s1·k - z1)/r. Returns up to TWO candidates, because a shared r means the nonce was k or n-k and the pair cannot choose between them without the public key -- low-S normalisation makes that common. The four ECDSA operations all work on ONE signature and nothing compares two, which is where ECDSA actually fails — the PS3 firmware key and the 2013 Android Bitcoin thefts were both this. Does NOT attack merely biased nonces; that needs a lattice and is not implemented.

Find WHERE a file's entropy is high, not just whether it is: contiguous regions above a threshold, with offsets. CyberChef's Entropy curve has a fixed 256-byte bin, no threshold and no region output. Applies Lyda and Hamrock's packed-binary rule (a CONJUNCTION of mean > 6.677 and peak > 7.199, not the single 7.0 usually quoted) and adds chi-squared and serial correlation as a second axis, which is what separates compressed from encrypted. Reports what a high number does and does not establish.

Recover the plaintext behind a fast unsalted hash from a wordlist: MD5, SHA-1, SHA-256/384/512 and NTLM. Follows hash_identify with the question that matters — is this password one anybody would guess? Deliberately REFUSES bcrypt, scrypt, Argon2, yescrypt and the crypt(3) family BY NAME rather than attempting them, because a pure-JS attempt would find nothing and imply the password was strong. Supply a wordlist; a small common-password list and cheap mutations are built in. Bounded to 20 seconds, about 24 million candidates.

Identify a password hash by its structure — bcrypt, sha512crypt, argon2, PHPass, Django, LDAP, MySQL, NetNTLM and others — and report the hashcat mode and John format name for each match. Falls back to length-based candidates for a bare digest. Use this before trying to crack something: CyberChef's Analyse hash operation reads hex length only and reports "Invalid hash" for bcrypt, sha512crypt and argon2.

Analyse a set of password hashes as a SET: which formats appear and in what proportion, which accounts share a password, which entries are locked or passwordless rather than hashed, and which algorithm is the weakest link. Answers questions that are properties of the corpus rather than of any single hash, so calling hash_identify in a loop cannot produce them. Accepts bare hashes one per line or user:hash records including /etc/shadow. Reads structure only — it never cracks anything and never reaches the network.

Report everything wrong with a JWT that can be established from the token alone. JWT Verify answers whether a signature is valid under a key you supply, which is a different question: alg: none has no signature to verify and one signed with secret verifies perfectly. Checks the algorithm (including the case and Unicode-escape variants that bypass naive filters), an empty signature, the ECDSA psychic signature (CVE-2022-21449), quickstart secrets, and the standard claims. Headers that only matter because of what a SERVER does with them — jku, jwk, x5u, kid — are reported as present, never as confirmed.

Decide whether a candidate is plaintext, and say which evidence decided it. This is the judgement every automatic-decoding search has to make and that no CyberChef operation exposes: Entropy, Chi Square and Index of Coincidence give the statistics, not the verdict. Reports printable ratio, English word hits, chi-squared against English letter frequencies and index of coincidence, with a verdict and the reason for it. Useful as the stopping condition when you are peeling layers off unknown data by hand.

Test an RSA public key for the generation flaws that make it breakable, and recover the private key when one applies: trial division, Fermat (primes too close), shared factors between two moduli, Wiener (private exponent too small), Pollard's rho (one prime too short), Pollard's p-1 (a prime whose predecessor is smooth) and unpadded small-e. None threatens a correctly generated key — a sound 2048-bit modulus defeats all of them — so a negative result is evidence the key is not weak in these specific ways, and not that it is strong. Decrypts a supplied ciphertext when the key is recovered.

Attack a SET of RSA keys, or several ciphertexts under one key, for leaks no single key shows: shared primes across a corpus in near-linear time (batch GCD), one message sent twice under one modulus with two exponents (common modulus), one message broadcast under a small exponent (Håstad), and two ciphertexts related by a known linear relation (Franklin–Reiter). Three of the four recover the message without factoring anything. Use rsa_attack for a single key.

Recover a monoalphabetic substitution mapping from ciphertext alone, by hill-climbing on English trigram fitness with random restarts. Substitute needs the mapping and no operation finds one. Also solves Caesar, ROT-N and Atbash. Measured on held-out prose: 83.6% of letters at 150, 91.2% at 250, 95.9% at 350 — so expect one or two letter pairs still swapped. Pin what you can read with known_mapping and run it again.

Given a number that might be a time, rank every format it could plausibly be — the step before CyberChef's date operations, which all need you to know the format already. Covers Unix at four resolutions, FILETIME, Chrome/WebKit, .NET ticks, UUIDv1, OLE Automation and Delphi, HFS+, Cocoa and GPS, and takes a v1 UUID directly. Always a ranked list: one 64-bit integer is a valid FILETIME, Cocoa date and nanosecond count at once, so a single confident answer would be wrong by construction.

Recover a Vigenere key from ciphertext alone. Vigenère Decode requires the key and no operation finds one. The index of coincidence per coset is used as a FILTER, not a judge — every multiple of the true length scores as well or better, which is the standard way this goes wrong — so a shortlist of lengths is solved in full and the plaintext's trigram score decides. Runners-up are reported per position, because a close second is where the answer is wrong. Exact key in 9 of 10 measured cases, and it reported its own failure on the tenth rather than a wrong key.

Recover the key length of a repeating-key XOR by three independent statistics — index of coincidence, autocorrelation and Kasiski — then score every candidate key byte per column against English and decrypt. Reports what each method concluded, so a disagreement is visible rather than averaged away. CyberChef's XOR Brute Force stops at a two-byte key. Measured over 72 cases: the exact length in 60%, and the length or a multiple of it — which still decrypts — in 96%. Least reliable on short inputs and on plaintext with its own strong period.

The Magic operation attempts to detect various properties of the input data and suggests which operations could help to make more sense of it.OptionsDepth: If an operation appears to match the data, it will be run and the result will be ana...