CyberChef: What the GCHQ Tool Does, How Recipes Work and Offline Use

CyberChef is a free, open-source web app from GCHQ (the UK’s signals intelligence and cyber security agency) for encoding, decoding, converting, hashing and encrypting data inside your browser. The official instance is at gchq.github.io/CyberChef and the source code, releases and wiki are at github.com/gchq/CyberChef; if you only came here looking for the tool, those two links are what you want.

The rest of this page is for developers who use CyberChef while building or debugging payment, smart-card and NFC software: what the tool actually does with your data, how recipes and deep links work, how to run it offline, and eight worked examples whose outputs we checked twice – once in the official web app and once with an independent Node.js script.

Scope: this is an independent engineering note. Ambimat is not affiliated with GCHQ or the CyberChef project. Operation names and behaviour were checked against CyberChef v11.5.0 (the latest GitHub release on 10 October 2026) and the live official instance on the same day. Every example uses public test vectors or synthetic data – no real card numbers, keys or tokens.

Where to get the official CyberChef

The project warns, in the app’s download dialog, that unofficial copies could have been modified to exfiltrate what you paste into them. Prefer the GCHQ-hosted site or a build you obtained from the GitHub repository yourself, rather than a “CyberChef online” mirror found through a search engine.

What CyberChef does with your data (and the exceptions)

The CyberChef README and the app’s Download CyberChef dialog both say the app has no server-side component: the recipe and the input are processed by JavaScript in your browser and are not uploaded when you bake. That claim comes with caveats that matter if you handle payment data:

• Three operations do reach the network. According to the app itself, Show on map fetches map tiles from wikimedia.org, DNS over HTTPS sends queries to Google or Cloudflare, and HTTP request calls whatever URL you give it. None of these is needed for the work on this page.
• The hosted site loads Google Analytics. The repository’s build script adds a Google Analytics snippet to the GitHub Pages build. When we loaded a deep link on 10 October 2026, the analytics request carried the page address without the #recipe=…&input=… part. That is an observation of one visit, not a guarantee – check for yourself in the browser’s Network tab, which is exactly what the project recommends.
• Deep links contain your input. CyberChef keeps the current recipe and input in the URL fragment (after #). Browsers do not send the fragment to the web server (RFC 3986, section 3.5), but the full URL still lands in your browser history, in sync services, and in any chat or ticket you paste it into. The input is only Base64-encoded, which anyone can reverse.
• Saved recipes live in browser storage. Save recipe writes to the browser’s local storage for the current profile; clearing the profile deletes them.
• No correctness guarantee for crypto. The project’s security policy states plainly that the security of its cryptographic operations should not be relied upon. Treat CyberChef as a debugging and test-vector tool, not as a component of a production key-management process.

The practical rule follows directly: never paste live keys, real PANs, PIN blocks, production tokens or customer data into any browser tool, CyberChef included. If you must inspect sensitive material, use an offline copy on an isolated machine under your organisation’s data-handling policy – and even then, prefer test keys.

How a CyberChef recipe works

The interface has four areas: the operations list on the left, the recipe in the middle, input at the top right and output at the bottom right. You build a recipe by dragging (or double-clicking) operations into the middle column and setting their arguments, which the app calls “ingredients”.

  Input text --encode (input charset)--> bytes
        |
        v
  [ op 1 ] --> [ op 2 ] --> [ op 3 ] ...     each op's output is the next op's input
        |
        v
  bytes --decode (output charset)--> Output pane

• Bake runs the recipe. With Auto Bake on (the default), it re-runs whenever the input, an argument or the recipe changes; switch it off for very large inputs.
• Step runs one operation at a time, and you can set a breakpoint on any operation so execution pauses before it. This is the quickest way to see where a multi-stage decode goes wrong.
• Character encodings matter. Typed input is first encoded to bytes using the charset shown in the input status bar, and the final bytes are decoded for display using the output charset. When you are working with binary data, convert explicitly with From Hex / To Hex rather than relying on what the output pane happens to render.
• Magic (in Flow control) tries to work out how data is encoded. Per the project wiki, it pattern-matches the input against known encodings, speculatively runs the matching decoders and scores each branch – magic bytes, valid UTF-8, entropy and byte-frequency comparison against natural languages. It is good at nested Base64/hex/gzip layers; it has no idea what an APDU or a TLV template means.
• Fork runs the rest of the recipe separately on each line (or each delimited chunk) of the input – useful for a log of many hex APDUs.
• Saving and sharing. A recipe can be exported as a deep link, in the compact “Chef format” used in URLs, or as clean or compact JSON. Load recipe accepts any of these.

Worked examples for payment and smart-card developers

Each example lists the operations (named exactly as in CyberChef’s operation list), the arguments you need to change from the defaults, the input and the output. Every output below was reproduced in the official web app on 10 October 2026 and recomputed by the Node.js script in the next section. The “Open in CyberChef” links load the recipe and the (public or synthetic) input.

1. Convert a hex APDU to Base64

Logs and REST payloads often carry APDUs as Base64 while card tools show hex. This command is a SELECT by AID for F0010203040506, the example AID used in Android’s host-based card emulation guide, built the way Google’s archived CardEmulation sample builds it: header 00A40400, a length byte, then the AID.

• Recipe: From Hex (Delimiter: Auto) → To Base64 (Alphabet: A-Za-z0-9+/=)
• Input: 00A4040007F0010203040506
• Output: AKQEAAfwAQIDBAUG
• Open in CyberChef

Reverse it with From Base64 → To Hex. To read a long hex trace with offsets, use To Hexdump.

2. Look inside a JWT without verifying it

Payment and terminal-management APIs frequently use JSON Web Tokens. JWT Decode shows the payload but, as its own description says, does not check the signature – use JWT Verify for that. The token below is synthetic: we signed it with HMAC-SHA256 and the throw-away secret not-a-real-secret. The sub and iat claims are defined in RFC 7519; 1767225600 is 2026-01-01 00:00:00 UTC.

• Recipe: JWT Decode
• Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vLXJlYWRlci0wMSIsImlhdCI6MTc2NzIyNTYwMH0.CsgO3DCL-ZCFnJYD1Cl7GkC1Wi47JCRrHEemSQykFj4
• Output: {"sub": "demo-reader-01", "iat": 1767225600} (pretty-printed in the app)
• Open in CyberChef

A real token is a bearer credential. Decoding one in a browser tab you share, or turning it into a deep link, can leak it.

3. SHA-256 of a string, checked against NIST

• Recipe: SHA2 (Size: 256; leave Rounds at 64)
• Input: abc
• Output: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
• Reference: NIST’s SHA-256 example with intermediate values (one-block message “abc”).
• Open in CyberChef

Cross-check from a terminal with printf abc | openssl dgst -sha256. Use printf, not echo: a trailing newline changes the digest, and the same trap exists in CyberChef if your input pane ends with an empty line.

4. XOR two hex blocks

XOR is the step that chains blocks in CBC mode: the first plaintext block is XORed with the IV before it is encrypted (NIST SP 800-38A, section 6.2). Using the values from SP 800-38A example F.2.1 you can reproduce NIST’s published “Input Block”:

• Recipe: From Hex → XOR (Key: 000102030405060708090a0b0c0d0e0f, key format HEX, Scheme: Standard) → To Hex (Delimiter: None)
• Input: 6bc1bee22e409f96e93d7e117393172a
• Output: 6bc0bce12a459991e134741a7f9e1925 – identical to F.2.1, Block #1, Input Block
• Open in CyberChef

If the key is shorter than the data, XOR repeats it; for block-against-block work make sure both are the same length.

5. AES-128 with a NIST test vector – and the padding trap

• Recipe: AES Encrypt (Key: 2b7e151628aed2a6abf7158809cf4f3c as HEX, IV empty, Mode: ECB/NoPadding, Input: Hex, Output: Hex)
• Input: 6bc1bee22e409f96e93d7e117393172a
• Output: 3ad77bb40d7a3660a89ecaf32466ef97 – matches NIST SP 800-38A F.1.1 (ECB-AES128.Encrypt), Block #1
• Open in CyberChef

Choose plain ECB instead and CyberChef applies PKCS#7 padding, as the operation’s description says. A 16-byte input then gains a full extra block and the output becomes 3ad77bb40d7a3660a89ecaf32466ef97a254be88e037ddd9d79fb6411c3f9df8. The first 16 bytes still match; the last 16 are just encrypted padding. Card cryptograms and MACs are normally computed over data the protocol has already padded, so a “wrong length” result usually means the tool added padding of its own.

6. Triple DES with NIST’s TDES example

Payment systems still contain a great deal of Triple DES. NIST withdrew SP 800-67 Rev. 2 on 1 January 2024, so TDEA is no longer an approved cipher for protecting new data – decryption and verification of data already protected with it remain allowed – but you will still need to reproduce legacy test vectors.

• Recipe: Triple DES Encrypt (Key: 0123456789ABCDEF23456789ABCDEF01456789ABCDEF0123 as HEX, IV empty, Mode: ECB, Input: Hex, Output: Hex)
• Input: 6BC1BEE22E409F96E93D7E117393172AAE2D8A571E03AC9C9EB76FAC45AF8E51
• Output: 714772f339841d34267fcc4bd2949cc3ee11c22a576a303876183f99c0b6de87832846b52f9e213d
• Reference: NIST’s ECB-TDES example values give the 32-byte ciphertext 714772F3 39841D34 267FCC4B D2949CC3 EE11C22A 576A3038 76183F99 C0B6DE87.
• Open in CyberChef

The output is one 8-byte block longer than NIST’s answer. Unlike AES Encrypt, Triple DES Encrypt in v11.5.0 has no NoPadding mode, so ECB and CBC always add PKCS#7 padding. Compare the first 32 bytes and ignore the final block (832846b52f9e213d, which is just the encrypted padding). The key field wants all 24 bytes; for a double-length (two-key) key, repeat the first 8 bytes at the end.

7. Luhn check digit for a synthetic number

• Recipe: Remove whitespace (if the number is grouped) → Luhn Checksum (Radix: 10)
• Input: 123456789012345 (synthetic – not a card number)
• Output: Checksum: 8, Checkdigit: 2, Luhn Validated String: 1234567890123452
• Open in CyberChef

“Checksum” is the mod-10 result for the string as typed (0 means it already passes); “Checkdigit” is the digit to append. The operation implements the general Luhn mod N algorithm, so radix 10 gives the familiar card-number check. Any space or dash makes it stop with an error, hence the Remove whitespace step. Passing Luhn says nothing about whether a number is real or issued.

8. Defang a URL and an IP address before pasting a log line

When you quote a terminal or gateway log in a ticket, chat tools turn URLs into live links. Defang URL and Defang IP Addresses rewrite them so they cannot be clicked or used by accident. The log line below is synthetic: example.com is reserved for documentation by RFC 2606, and 192.0.2.10 sits in the TEST-NET-1 documentation block from RFC 5737.

• Recipe: Defang URL (defaults: escape dots, http and ://; Process: Valid domains and full URLs) → Defang IP Addresses
• Input: Callback https://terminal-api.example.com/v1/status from 192.0.2.10
• Output: Callback hxxps[://]terminal-api[.]example[.]com/v1/status from 192[.]0[.]2[.]10
• Open in CyberChef

In its default mode, Defang URL on its own leaves a bare IP address alone, which is why the second operation is there. Defanging is only cosmetic: it does not remove secrets or customer data from the line, so redact those first.

Where CyberChef stops: EMV-style TLV data

CyberChef has a Parse TLV operation with a “Use BER” option, and it is tempting to point it at a card response. Reading the operation’s source shows its limits. The tag is always read as a fixed number of bytes (“Type/Key size”). “Use BER” only changes how the length is read: a short form, or a long form where the first byte gives the count of length bytes. Without BER, multi-byte lengths are read little-endian. It returns a flat list and does not descend into constructed templates.

BER allows multi-byte tags (the “high tag number” form), and real card data mixes one- and two-byte tags. Here is what happens with a synthetic string holding a one-byte tag 81 and a two-byte tag 9F 21:

• Recipe: From Hex → Parse TLV (Type/Key size 1, Length size 1, Use BER on)
• Input: 81 02 AB CD 9F 21 03 0A 0B 0C
• Output (abridged): the first element is correct (key [129], length 2, value [171, 205]). The second comes out as key [159] with length 33: CyberChef took 0x21, the second tag byte, as the length. The value is the four leftover bytes plus a null.
• Open in CyberChef

Setting the tag size to 2 just breaks the one-byte tags instead. Note also that keys and values are shown as decimal byte arrays, not hex. For EMV records and FCI templates, use a dedicated BER-TLV parser. The BER-TLV parser in JavaScript walkthrough handles multi-byte tags and nesting, and the EMV tag reference tells you what the tags mean. CyberChef is still useful around that step: hex clean-up, Base64 unwrapping, slicing with Take bytes/Drop bytes, and checking a cryptogram input once you know which bytes it covers. For DER-encoded structures such as certificates, Parse ASN.1 hex string and Parse X.509 certificate are the right tools.

Checking the example outputs independently

A tool you use to check test vectors should itself be checked. The script below recomputes every expected output on this page using only Node.js built-ins (node:crypto and Buffer) and no CyberChef code. The companion test file asserts the results against the NIST values quoted above and covers error cases: odd-length hex, non-hex characters, blocks of different length, malformed JWTs and non-digit Luhn input.

// Independent check of the CyberChef example outputs on this page.
// Uses only Node.js built-ins (node:crypto, Buffer). Run: node verify-examples.mjs
import { createCipheriv, createHash, createHmac } from "node:crypto";
import { fileURLToPath } from "node:url";

// Strict hex parser: rejects odd length and non-hex characters
// instead of silently truncating like Buffer.from(str, "hex") does.
export function hexToBytes(hex) {
  const clean = hex.replace(/\s+/g, "");
  if (clean.length % 2 !== 0) throw new Error("odd-length hex");
  if (!/^[0-9a-fA-F]*$/.test(clean)) throw new Error("non-hex character");
  return Buffer.from(clean, "hex");
}

// Example 1: From Hex -> To Base64
export function hexToBase64(hex) {
  return hexToBytes(hex).toString("base64");
}

// Example 2: build a synthetic HS256 JWT, so readers have a token to decode
const b64url = (buf) => Buffer.from(buf).toString("base64url");
export function makeDemoJwt(payload, secret) {
  const head = b64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
  const body = b64url(JSON.stringify(payload));
  const sig = createHmac("sha256", secret).update(`${head}.${body}`).digest("base64url");
  return `${head}.${body}.${sig}`;
}
// What CyberChef "JWT Decode" shows: the payload, signature NOT checked
export function decodeJwtPayload(token) {
  const parts = token.split(".");
  if (parts.length !== 3) throw new Error("JWT must have 3 parts");
  return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
}

// Example 3: SHA2 (size 256)
export const sha256Hex = (text) => createHash("sha256").update(text, "utf8").digest("hex");

// Example 4: XOR of two equal-length hex blocks
export function xorHex(a, b) {
  const x = hexToBytes(a), y = hexToBytes(b);
  if (x.length !== y.length) throw new Error("blocks differ in length");
  return Buffer.from(x.map((v, i) => v ^ y[i])).toString("hex");
}

// Examples 5 and 6: block ciphers in ECB mode, padding on or off
export function ecbEncryptHex(algorithm, keyHex, dataHex, pad) {
  const c = createCipheriv(algorithm, hexToBytes(keyHex), null);
  c.setAutoPadding(pad);
  return Buffer.concat([c.update(hexToBytes(dataHex)), c.final()]).toString("hex");
}

// Example 7: Luhn (mod 10) check digit for a digit string
export function luhnCheckDigit(digits) {
  if (!/^[0-9]+$/.test(digits)) throw new Error("digits only");
  let sum = 0;
  // Walk right to left over payload + placeholder "0"; double every second digit.
  [...(digits + "0")].reverse().forEach((ch, i) => {
    let d = Number(ch);
    if (i % 2 === 1) { d *= 2; if (d > 9) d -= 9; }
    sum += d;
  });
  return String((10 - (sum % 10)) % 10);
}

// Example 8: defang a log line. Applies the three default "Defang URL"
// substitutions to the whole string; replacing every dot also covers the IPv4
// address. ponytail: naive - right for this one synthetic line only; CyberChef
// uses URL/domain/IP regexes and leaves other dots alone.
export function defang(text) {
  return text.replace(/\./g, "[.]").replace(/http/gi, "hxxp").replace(/:\/\//g, "[://]");
}

// Inputs used on the page (all public test vectors or synthetic data)
export const APDU_HEX = "00A4040007F0010203040506";
export const JWT_PAYLOAD = { sub: "demo-reader-01", iat: 1767225600 };
export const JWT_SECRET = "not-a-real-secret";
export const AES_KEY = "2b7e151628aed2a6abf7158809cf4f3c"; // SP 800-38A F.1.1
export const AES_P1 = "6bc1bee22e409f96e93d7e117393172a";
export const CBC_IV = "000102030405060708090a0b0c0d0e0f"; // SP 800-38A F.2.1
export const TDES_KEY = "0123456789ABCDEF23456789ABCDEF01456789ABCDEF0123"; // NIST TDES_ECB example
export const TDES_PT = "6BC1BEE22E409F96E93D7E117393172AAE2D8A571E03AC9C9EB76FAC45AF8E51";
export const LUHN_PAYLOAD = "123456789012345"; // synthetic, not a card number
export const LOG_LINE = "Callback https://terminal-api.example.com/v1/status from 192.0.2.10"; // RFC 2606 / RFC 5737

export function results() {
  const jwt = makeDemoJwt(JWT_PAYLOAD, JWT_SECRET);
  return {
    "1 APDU hex -> Base64": hexToBase64(APDU_HEX),
    "2 demo JWT": jwt,
    "2 JWT payload": JSON.stringify(decodeJwtPayload(jwt)),
    "3 SHA-256(abc)": sha256Hex("abc"),
    "4 P1 XOR IV": xorHex(AES_P1, CBC_IV),
    "5 AES-128 ECB, no padding": ecbEncryptHex("aes-128-ecb", AES_KEY, AES_P1, false),
    "5b AES-128 ECB, PKCS#7": ecbEncryptHex("aes-128-ecb", AES_KEY, AES_P1, true),
    "6 3DES ECB, PKCS#7": ecbEncryptHex("des-ede3-ecb", TDES_KEY, TDES_PT, true),
    "7 Luhn check digit": luhnCheckDigit(LUHN_PAYLOAD),
    "8 defanged": defang(LOG_LINE),
  };
}

if (process.argv[1] === fileURLToPath(import.meta.url)) {
  for (const [k, v] of Object.entries(results())) console.log(`${k}: ${v}`);
}

Running node verify-examples.mjs prints:

1 APDU hex -> Base64: AKQEAAfwAQIDBAUG
2 demo JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vLXJlYWRlci0wMSIsImlhdCI6MTc2NzIyNTYwMH0.CsgO3DCL-ZCFnJYD1Cl7GkC1Wi47JCRrHEemSQykFj4
2 JWT payload: {"sub":"demo-reader-01","iat":1767225600}
3 SHA-256(abc): ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
4 P1 XOR IV: 6bc0bce12a459991e134741a7f9e1925
5 AES-128 ECB, no padding: 3ad77bb40d7a3660a89ecaf32466ef97
5b AES-128 ECB, PKCS#7: 3ad77bb40d7a3660a89ecaf32466ef97a254be88e037ddd9d79fb6411c3f9df8
6 3DES ECB, PKCS#7: 714772f339841d34267fcc4bd2949cc3ee11c22a576a303876183f99c0b6de87832846b52f9e213d
7 Luhn check digit: 2
8 defanged: Callback hxxps[://]terminal-api[.]example[.]com/v1/status from 192[.]0[.]2[.]10

The OpenSSL command line gives the same answers, for example printf 6bc1bee22e409f96e93d7e117393172a | xxd -r -p | openssl enc -aes-128-ecb -K 2b7e151628aed2a6abf7158809cf4f3c -nopad | xxd -p. Drop -nopad and you see the same extra padding block CyberChef adds.

Running CyberChef offline or on your own network

Because the app is static files, an offline copy behaves like the hosted one. You have three supported options:

1. Standalone ZIP. Use Download CyberChef in the app, or download the ZIP attached to a GitHub release (v11.5.0 was published on 18 September 2026). Unzip it and open it locally or serve it from any web server; no configuration is needed. The download dialog shows a SHA-256 hash for the ZIP, so check the file before you use it. The copy never updates itself, so fetch a new release when fixes come out.
2. Docker. The README documents a pre-built image (docker run -it -p 8080:8080 ghcr.io/gchq/cyberchef:latest) or building the image yourself from the repository’s Dockerfile. Then browse to http://localhost:8080.
3. From source. Clone the repository, install Node.js 24 and run npm install. npm start runs a development server; npm run build produces a production build in build/prod. The wiki notes that only bash-based environments (Linux, macOS) are supported for building.

An offline copy removes the dependence on a third-party website, and the GitHub Pages analytics snippet is added by the Pages build step. It does not make sensitive data safe on its own. The browser, its extensions, local storage and the machine itself are all still in scope.

Using CyberChef from Node.js

The npm package cyberchef wraps most operations as JavaScript functions. According to the project’s Node API wiki:

• You can load it with import chef from "cyberchef" or require("cyberchef"). The package declares support for Node.js 24 up to (but not including) 27.
• Operation names become camelCase (To Hex becomes toHex). Names starting with several capitals keep them, so SHA2 stays SHA2. Arguments go in an options object whose keys are camelCased argument names.
• Each call returns a Dish object. You can chain operations with .apply(), or run a whole recipe with the asynchronous chef.bake(input, recipe). chef.bake accepts the JSON produced by the web app’s Save recipe pane, so you can design a recipe interactively and replay it in a test.
• chef.help("operation name") shows an operation’s arguments and options.
• Flow-control operations such as Fork, Merge, Jump and Label are excluded and throw an error if called. Plain JavaScript loops do the same job.

We did not use the Node package to produce this article. In our environment (Node.js 25 on macOS, 10 October 2026), npm install cyberchef@11.5.0 stopped in the package’s own post-install step, which looks for the Grunt build tool. The outputs above were therefore checked in the official web app and against Node’s built-in crypto, not through the npm library. If you depend on the package, pin a version and run the install in CI before you rely on it.

Frequently asked questions

What is the official CyberChef website?

The official instance is https://gchq.github.io/CyberChef/, published by GCHQ from the gchq/CyberChef GitHub repository.

Is CyberChef safe to use – does it upload my data?

According to the project, processing happens in your browser and the input and recipe are not uploaded when you bake. The exceptions are the HTTP request, DNS over HTTPS and Show on map operations, which contact external services. The hosted site also loads Google Analytics, and deep links put your input in the URL. Do not paste production secrets into it.

Who makes CyberChef and what licence is it under?

CyberChef was created inside GCHQ, and the README says an analyst built and improved it in their 10% innovation time over several years. It is released under the Apache License 2.0 and is Crown Copyright. Contributors sign GCHQ’s contributor licence agreement.

Can I use CyberChef offline?

Yes. Download the standalone ZIP from the app or from GitHub Releases, run the official Docker image, or build it from source. The standalone copy does not update itself.

What is a CyberChef recipe?

A recipe is an ordered list of operations with their arguments; the output of each becomes the input of the next. Recipes can be saved to browser storage, exported as Chef-format text or JSON, or shared as a deep link that also contains the input.

Does CyberChef have an API?

There is a Node.js package, cyberchef, that exposes most operations as functions and can replay recipes exported from the web app with chef.bake. Flow-control operations are not available in it.

Can CyberChef parse EMV TLV data?

Only partly. Parse TLV needs a fixed tag width, so it mis-reads data that mixes one- and two-byte tags, and it does not unpack nested templates. Use a dedicated BER-TLV parser for EMV records. CyberChef remains handy for the hex, Base64 and byte-slicing steps around it.

Why does CyberChef give a longer AES or 3DES result than my test vector?

Padding. In CBC and ECB modes CyberChef adds PKCS#7 padding unless you pick a NoPadding mode, which AES Encrypt offers and Triple DES Encrypt (v11.5.0) does not. Compare the leading blocks, or use AES’s NoPadding modes.

What does “defang” mean in CyberChef?

Defanging rewrites a URL, domain or IP address so it is no longer clickable or usable, for example https:// becomes hxxps[://] and dots become [.]. CyberChef provides it as two operations, Defang URL and Defang IP Addresses.

Related reading on Ambimat

• How to parse BER-TLVs in JavaScript
• EMV and NFC BER-TLV tag reference
• Smart-card APDU commands reference
• The Luhn algorithm for card numbers
• What is token-based authentication?
• NFC card emulation mode for mobile payments
• Turning chip-card reader output into text

Sources

• GCHQ, CyberChef – README.md, master branch (package version 11.5.0), sections “Running Locally”, “How it works”, “Features”, “Deep linking”, “Licencing”; retrieved 10 Oct 2026. github.com
• GCHQ, CyberChef Security Policy (SECURITY.md), “Support”; retrieved 10 Oct 2026. github.com
• GCHQ, CyberChef in-app help text (src/web/html/index.html: “Download CyberChef” dialog, Recipe, Save/Load recipe, Step, Bake and Auto Bake help); retrieved 10 Oct 2026. github.com
• GCHQ, CyberChef official instance, About/Support and Download dialogs as served (version 609951ac, compiled 3 Oct 2026); observed 10 Oct 2026. gchq.github.io
• GCHQ, CyberChef operation list (src/core/config/Categories.json); retrieved 10 Oct 2026. github.com
• GCHQ, CyberChef operation sources: ParseTLV.mjs and lib/TLVParser.mjs, AESEncrypt.mjs, TripleDESEncrypt.mjs, LuhnChecksum.mjs, JWTDecode.mjs, DefangURL.mjs, DefangIPAddresses.mjs, lib/Extract.mjs; retrieved 10 Oct 2026. github.com
• GCHQ, Gruntfile.js (task copy:ghPages) and src/web/static/ga.html; retrieved 10 Oct 2026. github.com
• GCHQ, CyberChef wiki: Node API, “Compatibility”, “Usage”, “bake”, “Excluded operations”; and src/node/config/excludedOperations.mjs; retrieved 10 Oct 2026. github.com
• GCHQ, CyberChef wiki: Getting started, “Installing”, “Compiling”; retrieved 10 Oct 2026. github.com
• GCHQ, CyberChef wiki: Automatic detection of encoded data using CyberChef Magic; retrieved 10 Oct 2026. github.com
• GCHQ, CyberChef release v11.5.0, published 18 Sep 2026. github.com
• npm, cyberchef package metadata (version 11.5.0, engines node >=24 <27, licence Apache-2.0); retrieved 10 Oct 2026. npmjs.com
• Apache Software Foundation, Apache License, Version 2.0 (as distributed in the CyberChef LICENSE file). apache.org
• M. Dworkin, NIST, SP 800-38A: Recommendation for Block Cipher Modes of Operation, Dec 2001, section 6.2; Appendix F.1.1 (p. 24) and F.2.1 (p. 27). doi.org
• NIST CSRC, Cryptographic Standards and Guidelines – Examples with Intermediate Values: SHA-256 (one-block message “abc”). csrc.nist.gov
• NIST CSRC, Examples with Intermediate Values: TDES ECB mode (ECB-TDES Encryption). csrc.nist.gov
• NIST, SP 800-67 Rev. 2: Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher, withdrawal notice (withdrawn 1 Jan 2024). csrc.nist.gov
• T. Berners-Lee, R. Fielding, L. Masinter, RFC 3986: Uniform Resource Identifier (URI): Generic Syntax, Jan 2005, section 3.5. rfc-editor.org
• M. Jones, J. Bradley, N. Sakimura, RFC 7519: JSON Web Token (JWT), May 2015, sections 4.1.2 and 4.1.6. rfc-editor.org
• D. Eastlake, A. Panitz, RFC 2606: Reserved Top Level DNS Names, Jun 1999, section 3; J. Arkko, M. Cotton, L. Vegoda, RFC 5737: IPv4 Address Blocks Reserved for Documentation, Jan 2010, section 3. rfc-editor.org
• Android Developers, Host-based card emulation overview (SELECT AID routing; example AID F0010203040506); retrieved 10 Oct 2026. developer.android.com
• Google (archived sample), android-CardEmulation: CardService.java, SELECT_APDU_HEADER and BuildSelectApdu. github.com
• Let’s Encrypt (ISRG), A Warm Welcome to ASN.1 and DER, “Tag”, updated 21 Mar 2021. letsencrypt.org
• Microsoft Learn, Encoded Length and Value Bytes (short and long length forms), updated 7 Jan 2021. learn.microsoft.com

Written by the Ambimat engineering team. Example outputs checked in the official CyberChef web app on 10 October 2026; verification script tested on Node.js 25.8.2.