> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/add-ons/malware/concepts/cyberchef.md).
# CyberChef
CyberChef is GCHQ's "Cyber Swiss Army Knife". It is a standalone web page with hundreds of data transformation operations. You drag operations into a recipe, give it data, and the output updates in real time. You do not have to install software, CyberChef does not send your data to a remote server, and the interface makes it easy to try different operations.
For example, when you think that data is XOR-encoded, you can try keys and see immediately if the output looks like plaintext. If you find AES-encrypted data and do not know if the mode is CBC or CTR, try both.
During reverse engineering, you often move data between IDA and CyberChef. You find an encrypted region in a binary, copy the bytes, paste them into CyberChef in a browser tab, find the correct transformation, and then copy the result back into IDA. This takes time, and it is easy to make a mistake.
The CyberChef plugin removes these steps. It puts the CyberChef data transformation engine into IDA Pro, with a panel next to your disassembly. Data goes from top to bottom through three areas: input, recipe, and output.
{% hint style="info" %}
CyberChef comes from the open source [ida-cyberchef](https://plugins.hex-rays.com/hexrayssa/ida-cyberchef/ida-cyberchef) plugin, which is available for free in the IDA plugin repository. It is optional and is not in the add-on archive. When hcli installs the add-on online, it also installs ida-cyberchef if it can. This install needs Node.js and npm. If hcli cannot install ida-cyberchef, it skips it, and the **Data Transformation** menu item does not show. The offline bundle does not include CyberChef on any platform. CyberChef does not load on Python 3.13.0 to 3.13.12 or on Python 3.14.0.
{% endhint %}
## Input
The plugin reads data directly from your IDB. It can follow your cursor, and transform and show a slice of data from that address. As you move through the disassembly, it reads bytes at the current position and applies the recipe in real time. This helps you to test a hypothesis. For example, if you found an XOR key and want to see how it decodes a region of data, scroll through the region and look at the result.
You can also use the selection, or type an address range. You can always paste or type data directly, as in the CyberChef web interface, and select if the data is a string, hex, or base64. To send a region to a panel, select it and use **CyberChef → Send to CyberChef-A** in the context menu:
## Recipe
To make your recipe, use the search bar to find an operation in the approximately 440 supported operations. The search uses fuzzy matching. For malware analysis, the most frequently used operations are XOR variants (also XOR brute force), byte operations such as shift and invert, AES and RC4 encryption, and hash algorithms. The full CyberChef catalog is available, for example protobuf decoding, to and from charcode, and CitrixCTX1 Decode. When you move the mouse over an operation, the plugin shows its documentation.
You can put many operations in a recipe, and the result updates when you change a parameter. This works as in the web interface, but your data stays in IDA.
## Output destinations
When you have the correct transformation, you can send the output to different destinations. The simplest are the clipboard and a file. When you copy, you select the format (hex dump, hex string, C-style array, raw bytes, or plain string), so that you can paste the result into reports or other tools.
Two destinations are specific to IDA. The first adds the decoded data as a comment at the source address. Use this to annotate encrypted strings without changes to the bytes in the database. The comment shows in the IDB what the data decodes to:
The second patches the transformed bytes into the IDB. Use this when you decoded an embedded configuration and want cross-references to its fields in IDA. When you apply types to the decoded bytes, such as a custom structure, IDA shows the data more clearly:
## Under the hood
The plugin does not port the 440 operations from JavaScript to Python or C++. It runs the CyberChef JavaScript code in a JavaScript engine in IDA. This needs only a small amount of code, and the plugin can use the work of the CyberChef community and contribute back to it.
Some operations need a web browser, so the plugin cannot support them. For example, YARA scanning needs the YARA library in a form that the embedded engine cannot load.
You can also use the CyberChef engine as a Python library. Give it data and a recipe as Python data structures, and get the result back:
```python
from ida_cyberchef import bake
bake(b"\x29\x24\x2d\x2d\x2e", [{"op": "XOR", "args": {"key": {"option": "Hex", "string": "41"}}}])
```
For the background, see the blog post [IDA Pro, Meet CyberChef](https://hex-rays.com/blog/ida-pro-meet-cyberchef).
## Configuration
To open a CyberChef panel, select **Extensions → Malware Analysis → Data Transformation → Open CyberChef** or **View → Open subviews → CyberChef**, or press Shift + C. You can open up to 26 panels, named `CyberChef-A` to `CyberChef-Z`.
CyberChef has no settings. You select these options in each panel:
| Option | Values | Default | Description |
| ------------------ | --------------------------------------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Input source | Manual Input, From Cursor, From Selection, From Location | Manual Input | From Cursor reads 256 bytes at the cursor and follows it. From Selection follows the selection in the disassembly and hex views. From Location reads a fixed address and length, and does not follow the cursor. |
| Input format | Text (UTF-8), Hex String, Base64 | Text (UTF-8) | How to interpret manual input. Not available for the other input sources. |
| Address and length | hexadecimal address, decimal length or end address | length 256 | The range to read in From Location mode. |
| Output format | Depends on the result type | Hex Dump for bytes, Pretty JSON for JSON | Bytes can show as Hex Dump, Text, Hex String (spaced or unspaced), String Literal, C Array (hex or decimal), or C Variable. |
| Output destination | Copy to clipboard, Save to file, Copy to IDB, Set comment | none | Copy to IDB patches the bytes into the database, and is available only for bytes output from the From Selection or From Location input sources. Set comment adds the output as a comment at the start of the input range, or at the cursor. |
The input area shows only the first 256 bytes of the input, but the recipe gets all the data. An asynchronous operation stops after 10 seconds. CyberChef does not save the recipe, input, or input source. When IDA restores a desktop layout, CyberChef panels open empty.
If you have a question, an idea, or a problem, email . The Malware Analysis team reads every message and replies quickly.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.hex-rays.com/add-ons/malware/concepts/cyberchef.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.