Loading…
Chain encoding, hashing, cipher, and analysis operations into a live recipe — a private, in-browser CyberChef alternative. Your data never leaves your device.
The Cyber Swiss Army Knife is a recipe builder: instead of running one fixed conversion, you stack operations into a pipeline and watch the input flow through them, step by step, live. Add From Base64, then Gunzip-style decoders, then JSON Beautify, and each stage feeds the next — the same way you would pipe commands in a shell, but visual, reversible, and shareable. It is a client-side alternative to CyberChef, built directly on this site's operation engine, so every transform runs in your browser and nothing you paste is ever uploaded.
Why chaining is the whole point. Real-world data is rarely encoded once. A token is Base64, wrapped in URL-encoding, sometimes hex on top. A malware sample's configuration might be Base64 → XOR-adjacent transform → JSON. A CTF flag is deliberately layered to make you peel it. Any single-purpose decoder forces you to copy the output, paste it into the next tool, and repeat — losing the intermediate state every time. A recipe keeps the entire chain in one place: you see the output of every step, you can disable a step to compare, reorder steps to test a hypothesis, and tweak one argument and watch the final result update instantly.
A worked example. Paste a JWT's payload segment and build the recipe From Base64URL → JSON Beautify. The first step turns the opaque eyJ... string into raw JSON; the second pretty-prints it so the claims are readable. Want the SHA-256 of the result? Append a SHA-256 step. Decide the input was actually hex, not Base64? Swap the first operation and the whole chain re-runs. Each intermediate output is shown under its step, and if a step fails — malformed Base64, invalid JSON — the error is reported inline at exactly that step rather than blanking the whole tool.
The operation catalog. Operations are grouped the way you reach for them: Encoding (Base64, Base64URL, hex, URL percent-encoding, HTML entities, in both directions), Hashing (MD5, SHA-1, SHA-256, SHA-512, and keyed HMAC), Cipher (ROT13, Caesar, Atbash, Vigenère for classical/CTF work), Text (case conversion, trim, reverse, regex find-and-replace), Data (JSON parse, beautify, and minify), Network (IP and CIDR breakdowns), and Analysis (Shannon entropy, character-set and letter-frequency profiling, hash identification, file-signature detection, and a static ReDoS check). Every one is a pure function — no network, bounded input, no code execution — which is exactly why the whole thing can run offline in a tab.
Security use-cases. For malware and phishing triage, decode a suspicious blob layer by layer to reveal a configuration, a second-stage URL, or an obfuscated PowerShell command without ever executing it. For CTFs, a recipe is the fastest way to try From Base64 → From Hex → ROT13 permutations until the flag falls out. For appsec, chain URL Decode → HTML Entity Decode to see what a double-encoded payload really becomes, or run Detect Charset → Shannon Entropy to judge whether a captured string is a secret, a hash, or plaintext. When you recognise the inner format, jump to the dedicated Base64 decoder, hex converter, or hash generator for a focused view.
The privacy advantage. Many online "CyberChef alternative" sites process your input on their server, which means every token, credential, or malware artifact you paste is transmitted and potentially logged. Here the engine is pure client-side JavaScript: the operations execute in your browser, and the only thing that ever leaves the tab is the URL you choose to copy. That makes it safe for exactly the sensitive material — session tokens, internal hostnames, incident evidence — you should never hand to a third party.
Share a recipe, not a screenshot. The entire workspace — your input and every step — is encoded into the page URL, so a link reproduces the exact recipe for a teammate. The link is generated locally and updates as you work; nothing is stored on a server.
Encode text to Base64 and Base64URL, and decode Base64 back to readable text with a hex view of the raw bytes — both directions, in your browser.
Base64, base64url, hex, percent-encoding, and HTML entities in one pass.
Convert hexadecimal to readable UTF-8 text and text to hex, tolerant of spaces and colons — both directions in your browser.
Escape text to HTML entities or decode entities back, to reason about XSS and safe output encoding.
Percent-encode text for safe use in URLs and query strings, and decode percent-encoded values back to plain text — including a second pass that exposes double-encoding.
Encode and decode Base64 text and files.