Decode anything with GCHQ's CyberChef
Britain's intelligence agency gave away its "cyber Swiss army knife". It runs in your browser, needs no install, and turns scrambled text, scam links and mystery files into something you can read.
- Suspicious links made safe to share, and downloads checked against their official fingerprint
- One-click recipe links for every example, plus a three-layer decode challenge to finish
- A browser. That's it.
Open CyberChef and learn the four boxes
Everything in CyberChef works the same way, so learn it once.
Open gchq.github.io/CyberChef ↗. It's the official site from GCHQ's GitHub account, and the code is open source (Apache-2.0). Your data is processed in your own browser, not sent to a server.
- Operations (left): over 500 tools. Search for one at the top.
- Recipe (middle): drag operations here. They run top to bottom, like a recipe.
- Input (top right): paste text or open a file.
- Output (bottom right): the result, updated instantly.
Let Magic decode it for you
Don't know what something is? CyberChef can usually work it out.
Paste this into Input, then drag Magic (in Favourites) into the Recipe:
InputSGVsbG8gZnJvbSBDcmFja2VkIEFJLiBZb3UganVzdCBkZWNvZGVkIGJhc2U2NCE=
Magic spots that it's Base64 and decodes it straight away. That's Base64, a way of writing any data as letters and numbers. You'll find it in emails, web addresses and config files. Click a suggested recipe in the output to load it. Open this example in CyberChef ↗.
TipWhen Magic finds nothing, open its options and tick Intensive mode. It then tries harder, running more decodings and combinations, which often cracks something wrapped in two or three layers. It's slower, so leave it off for everyday one-layer jobs.
Unwrap a tracking link
See where a link really goes, and what it's telling the site about you.
Links in emails and search results are often wrapped in a redirect, with the real address scrambled inside. Paste this example into Input and use the Parse URI operation:
Inputhttps://www.google.com/url?q=https%3A%2F%2Fshop.example.com%2Fsale%3Futm_source%3Dnewsletter%26utm_campaign%3Dautumn&sa=D&ust=1759800000
The real destination is the qvalue. Theutm_parts tell the shop which newsletter and campaign you came from.Open this example in CyberChef ↗.
TipDelete everything after a?that starts withutm_before you share a link. The page still works, and you stop passing on tracking tags.
https://shop.example.com/sale as the real destination in the output.Unmask a scam link hiding inside another link
Scam texts often bury the real site in Base64 so filters and people can't read it. Peel it back.
Here's the kind of link a fake refund text uses. The real destination is the scrambled
u=value at the end:Scam text linkhttps://l.sms-link.example/r?u=aHR0cHM6Ly9obXJjLXJlZnVuZC1jbGFpbS5leGFtcGxlL2xvZ2luP2lkPTQ0MTI%3D- Copy only the part after
u=into Input. - Add URL Decode (turns
%3Dback into=). - Add From Base64 underneath. The real address appears.
- Add Defang URL last, so the result can't be clicked by accident.
Outputhxxps[://]hmrc-refund-claim[.]example/login?id=4412- Copy only the part after
A "refund" site that isn't on gov.uk, asking you to log in: that's a phishing page. Open this recipe in CyberChef ↗.
hmrc-refund-claim address, defanged.Make a suspicious link safe to share
Warn a friend or report a scam without anyone clicking the link by accident.
Paste a dodgy message into Input and use Defang URL on its own. It rewrites links so they can't be clicked:
OutputInput: Your parcel is held: https://parcel-redelivery-fee.example/pay?id=8831 Output: Your parcel is held: hxxps[://]parcel-redelivery-fee[.]example/pay?id=8831Security teams share scam links this way. Send the defanged version in group chats or when reporting it. Open this example in CyberChef ↗.
CarefulNever paste passwords, bank details or anything private into any website, CyberChef included, unless you're using the offline version. Don't open a suspicious link to "check" it. In the UK, forward scam texts to 7726 and scam emails to report@phishing.gov.uk.
hxxps[://] and can't be clicked.Check a download is the real thing
Many projects publish a "SHA-256" fingerprint. If yours matches, the file wasn't tampered with.
Open CyberChef with SHA-256 ready ↗, then click the open file icon on the Input panel and choose the file you downloaded. CyberChef reads it in your browser.
Compare the 64-character result with the one on the project's official download or Releases page. Windows has the same check built in, and both tools give the identical fingerprint for the same file:
Windows (PowerShell)Get-FileHash .\yourfile.zip -Algorithm SHA256Macshasum -a 256 yourfile.zipTipYou can drag a file straight from your file manager onto the Input panel instead of using the open-file icon. It still reads the file inside your browser, nothing is uploaded.TipA different fingerprint means a different file. Don't run it: download it again from the official page.
Final challenge: crack a three-layer message
Put it all together. Magic gets you most of the way; the last layer is up to you.
This message has been wrapped three times. Paste it into Input and decode it:
Challenge54474a6f4948426c626e4234636e4567646d637549455679626e6b67626d46756557786d5a32596763485675646d45675a584a77646d4e795a694279613235775a336c7349486c32654849675a3356325a69343d- Start with Magic. It peels off two layers and gives you a recipe to click.
- The result is real words, but jumbled. Look at the letters: the same short words keep repeating in a shifted form.
- Find the operation that shifts every letter back, add it under the recipe Magic gave you, and read the message.
If it breaksI've got "Lbh penpxrq vg..." and can't go further.
I've got "Lbh penpxrq vg..." and can't go further.
Your first wins
It works. Now do something with it.
Ask AI what a recipe does
CyberChef recipes can be saved and shared as text. Paste one into Claude or ChatGPT to understand it:
Explain this CyberChef recipe step by step in plain English, and what kind of input it's designed for:
[paste the recipe from the save icon]Share your own recipe link
Built a recipe you like? Click the save icon above the Recipe and copy the link. Anyone who opens it gets your exact recipe, just like the links in this mission.
Pair it with Level 0
Spotting fake repos is easier when you can check fingerprints. Every time a GitHub release lists a SHA-256, now you can verify it.
Next: strip the location out of your photos
Photos can carry the GPS spot they were taken. Remove it before you share them.
Undo it cleanly
How to remove everything this mission installed.
Nothing to uninstall. If you downloaded the offline version, delete its folder.
