CyberChef Alternative: Online Encode, Decode, Hash
This is a free alternative to CyberChef for the everyday decoding jobs: build a recipe of steps such as From Base64, Gunzip, XOR, From Hex, URL Decode and Defang, and watch the output change as you type. Everything runs in your browser. Below the recipe box you will find a tool for each single job, from hashes to JWTs.
Not affiliated with or endorsed by the CyberChef project or GCHQ. It has many more operations than this page; see "This page or the original" below for when to use which.
No steps yet. The output equals the input. Add an operation below, or load a recipe above.
Runs in your browser. Nothing you paste is sent to PlayCISO or anywhere else.
What the recipe box can do
- Encodings: Base64 (standard and URL-safe), hex, binary, URL percent-encoding and HTML entities, both directions.
- XOR: a repeating text or hex key. You provide the key.
- Gzip: compress and decompress with the browser's own CompressionStream, so no library is loaded.
- Hex dump: offset, bytes and ASCII, 16 bytes a line, for anything that is not text.
- Defang and refang: make indicators safe to paste into a ticket or chat, and reverse it.
- Text: ROT13, reverse, upper and lower case.
What it does not do: hashing, AES or other block ciphers, UTF-16 decoding, automatic detection of encodings, or file input. Use the tools below, or the original, for those.
A tool for each job
When you only need one conversion, a dedicated page is faster and explains the format. Each runs in your browser.
Encodings
- Base64
Text, files and images, standard and URL-safe.
- URL encode / decode
Component versus whole-URI, plus a query-string breakdown.
- HTML entities
Named, decimal and hex entities.
- Number base converter
Hex, decimal, binary and octal.
- Binary translator
Text to binary and back.
- Punycode converter
xn-- domains, with homograph checks.
- Morse code translator
Text to Morse and back, with audio.
- ASCII table
Decimal, hex, binary and control codes.
Ciphers and hashes
- Hash generator
MD5, SHA-1, SHA-2 and CRC32 of text or files.
- Hash identifier
Work out which algorithm made a hash.
- HMAC lab
Compute and verify HMAC tags.
- ROT13 / ROT5 / ROT47
Simple rotation ciphers.
- Caesar cipher
Encode, decode and brute-force a shift.
- Vigenere cipher
Keyword-based substitution.
Parsing and comparing
- JWT decoder
Read the claims and check the signature.
- JSON formatter
Beautify, minify and validate.
- Regex tester
Matches, groups and replace.
- Diff checker
Line and word level differences.
- Epoch converter
Unix timestamps to dates and back.
This page or the original
| Need | Use |
|---|---|
| Peel Base64, hex, URL or gzip layers off a sample | This page |
| Defang indicators before pasting them into a ticket | This page |
| One conversion plus an explanation of the format | The dedicated tools above |
| AES, DES, Blowfish, IPv6 or X.509 parsing, checksums, file input, auto-detecting an encoding | The open source original, which lists these among its operations. Run it locally for sensitive samples (the README shows Docker and npm). |
Where recipes matter in security work
Attackers stack simple wrappers, such as gzip inside Base64 inside a URL parameter, because each layer is cheap and breaks naive string matching. Taking them off one at a time, and writing down the order, is a basic skill in alert triage and malware triage. Practise it on real alerts in the SOC Log Triage Trainer and the Forensics Lab, and read how hash identification fits into incident work. Warm up with beginner CTF challenges, where encoding layers are a staple.
Handle samples with care: decode suspicious content on an isolated machine, not a production one.
Frequently asked questions
What is a good online alternative to CyberChef?
For quick jobs, the recipe box on this page chains Base64, hex, binary, URL, HTML entity, ROT13, XOR, gzip, hex dump and defang steps in your browser. For one-off conversions, the dedicated tools linked above cover the same ground one at a time. CyberChef itself is open source and has far more operations, so keep it for anything this page does not do, such as AES, auto-detection of encodings or file input.
Who created CyberChef?
CyberChef is published by GCHQ, the UK signals intelligence agency, as the open source project gchq/CyberChef on GitHub. Its README says it was conceived, designed and built by an analyst in their innovation time over several years, and it is licensed under Apache 2.0. PlayCISO is not affiliated with it.
Is CyberChef safe to use?
The project is open source and its README describes it as a web app that runs operations within your browser, and it explains how to run your own copy with Docker or npm. Whichever online tool you use, treat what you paste as shared: do not paste live passwords, keys or customer data into any website. For sensitive samples, run a local copy offline.
Does CyberChef send data to a server?
We have not audited it and will not claim either way. Its README describes a browser-based app and gives instructions for running it locally, which is the way to be certain nothing leaves your machine. The recipe box on this page runs entirely in your browser: nothing you paste is sent to PlayCISO or anywhere else.
How do you use a recipe tool like this?
Paste your data into Input, then add steps in the order the data was wrapped, working from the outside in. If a payload was gzipped and then Base64-encoded, add From Base64, then Gunzip. Each step feeds the next, and the output updates as you type. If a step fails, it is highlighted and the output shows the result of the steps before it.
How do I decode Base64 and then decompress gzip?
Add From Base64, then Gunzip. Base64 text that starts with H4sI is a common sign of gzip data, because the gzip header bytes 1f 8b encode to those characters. If Gunzip reports invalid data, the content may use another format such as zlib, which this page does not handle.
What does it mean to defang a URL?
Defanging rewrites a link or address so it cannot be clicked or fetched by accident, for example hxxps://login[.]example[.]com. Analysts use it when pasting indicators into tickets, chat and reports. Refang reverses it so you can look the indicator up. The Defang step here changes http to hxxp and every dot between two letters or digits to [.], so it also changes dots inside file names.
How does the XOR step work?
Each byte of the data is XORed with the next byte of the key, and the key repeats. Type a text key, or start with 0x for hex bytes such as 0x5a or 0x41 0x42. Applying the same key again restores the original, so XOR is obfuscation and not strong encryption. This page does not guess a key; you supply it.
Can this page hash, encrypt or decrypt AES?
No. It does encoding, XOR, gzip and text clean-up. For hashes use the Hash Generator and Hash Identifier, and for message authentication use the HMAC Lab. For AES and other ciphers, use a local tool you trust.
Why does my output show as a hex dump?
When the result is not valid UTF-8 text, for example after Gunzip on a binary file or XOR with the wrong key, the page shows it as a hex dump with offsets and ASCII so you can read the bytes. Text that is UTF-16, such as a PowerShell encoded command, also appears this way because it contains zero bytes between the letters.
Sources
- gchq/CyberChef README and licence on GitHub (accessed 3 November 2026)
- RFC 4648: The Base16, Base32, and Base64 Data Encodings
- RFC 1952: GZIP file format specification version 4.3
- RFC 3986: Uniform Resource Identifier (URI): Generic Syntax, section 2.1 percent-encoding
- MDN: CompressionStream and DecompressionStream
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.