Host CyberChef without installing anything
The cyber swiss army knife, with one detail that changes everything: the processing runs in your browser, never on the server.
Starting at €2.99/month
Introduction
CyberChef installed, updated and backed up by us, on a machine in France. The swiss army knife of data analysis: encoding, encryption, compression, extraction, all by dragging recipes into place. You install nothing and configure no server: the application is online a few minutes after you order, under your own name.
The plan that suits it is App Découverte at €2.99/month incl. VAT — 1 GB of memory, against a theoretical minimum of 256 MB, and it is the smallest in our catalogue. The reason is simple: CyberChef computes nothing on the server side. The machine only serves a page and its JavaScript; all decoding, decryption and decompression happen on your own device. We are not going to sell you memory for software that does not use it.
There is nothing to migrate and nothing to back up: a recipe — the chain of operations you assemble — is kept in a link or in a file you download. So you can archive your useful recipes in the team wiki, share them in a message, and load them back unchanged months later.
What managed hosting changes
Recipes chained by drag and drop
You stack operations: strip the URL, decode the base64, decompress, extract with a regular expression. The result recomputes on every change, and the whole recipe is kept in a link or in a file.
Nothing leaves your browser
Every operation runs client-side. The server sends the page, then stops being involved. It is verifiable in a minute: cut the network once the tool has loaded and it keeps working. That is the argument that separates CyberChef from the online decoders people paste production tokens into without thinking.
The "Magic" operation, which guesses
Faced with an unknown string, Magic tries the plausible encodings and proposes the most likely chain of operations — base64 hiding gzip hiding hex, it works it out on its own.
Far more than base64
MD5, SHA and HMAC digests, AES, DES and RSA, JWT decoding and signature checking, gzip, zlib and bzip2, archive extraction, character-set conversion, CSV to JSON, dates and timestamps, subnet maths, defanging of malicious URLs, QR codes, entropy measurement.
Why hand it over rather than install it
An analyst pulling apart a suspicious attachment
Extract URLs with a regular expression, defang them so they can be quoted safely, decode the base64 payload and measure the entropy of the result — all without ever sending the sample to a third-party service.
A developer inspecting a production token
A JWT's contents are read and its signature verified inside the page. Nobody pasted a valid token into the first decoder a search engine turned up.
An administrator with a badly encoded export
The file arrives in Windows-1252, has to leave in UTF-8, and the date column is in Unix timestamps. Three chained operations and the file is clean.
A cybersecurity trainer
One instance for the room, one address for everyone, and recipes prepared in advance that participants open from a link. No workstation to set up.
A support team facing an unreadable frame
Hex to convert, a timestamp to read, an IP address to place in a subnet: all three operations sit in the same place instead of being scattered across five different sites.
An analysis tool served from France
The page comes from our own datacentre in Nouvelle-Aquitaine, with no analytics and no third-party script — which matters for a tool you open with sensitive data on screen.
Frequently asked questions
No. CyberChef is a fully client-side application: the server sends the HTML and the JavaScript, then has nothing more to do with what you paste in. Verifying it takes a minute — load the page, cut your connection, keep working: everything runs. That is exactly why it suits data you would not hand to anyone.
Because the code running on your machine still comes from somewhere. Loading CyberChef from a site you do not control means trusting that site with the JavaScript it serves, on every visit. Hosting it pins the version, keeps the tool available even on a closed network, and gives your team an internal address to use — which cuts short the reflex of reaching for whichever online decoder comes up first.
Three, honestly. Input size is bounded by browser memory: beyond a few tens of megabytes, the tab suffers. The tool is interactive and exposes no API: to process a thousand files you want command-line scripts, not CyberChef. And it does not replace a full forensics suite — it is a workbench, not a laboratory.
Nothing. You choose the application, fill in the two or three fields it asks for, and it goes online; the address and credentials arrive by email. The recommended plan for CyberChef is App Découverte, at €2.99/month incl. VAT with 1 GB of memory, and it can be changed later without reinstalling.
Yes, they are part of the service. A self-hosted application left un-updated is a security risk, not a saving. Version upgrades are applied and checked by us, with a backup kept for 14 days so you can roll back from the client area.