Self-hosted online decoder alternative: keep sensitive data in your browser with CyberChef

There's a tool almost everyone in tech reaches for without thinking: the quick online decoder. A base64 string you need to read. A JWT you want to inspect. A hex blob, a URL-encoded mess, a timestamp that isn't human. You paste it into the first result on Google, get your answer, and move on. The problem is what you just pasted. That token, that cookie, that fragment of production data went to someone else's server — logged, maybe, ad-funded, definitely out of your hands. CyberChef is the toolbox that does all of it without the paste ever leaving your browser.

What CyberChef is

CyberChef calls itself the Cyber Swiss Army Knife, and for once the label undersells it. Built and open-sourced by GCHQ — the UK's signals-intelligence agency — it bundles hundreds of data operations into a single web app: encode and decode, encrypt and decrypt, hash, compress, parse, convert, extract. You build a *recipe* by dragging operations into a stack, feed in your input, and watch the output update as you go.

The important part is where the work happens. Every operation runs in your browser, in JavaScript, on your machine. Nothing is uploaded — no account, no API call, no server round-trip. The random online decoders it replaces are single-purpose, ad-choked, and quietly logging whatever you feed them. CyberChef is the full workbench, and it keeps your data local by design.

The features that actually matter

CyberChef's surface is enormous, so here's what earns its keep day to day:

• Recipes you build by dragging — Stack operations in any order, reorder them live, and disable steps without deleting them. A recipe is a repeatable pipeline, not a one-off click.
• Hundreds of operations in one place — From Base64, Hex, URL, and Base32 to ROT13, XOR, and Morse — the everyday encodings plus a long tail you'll be glad exists the day you need it.
• Real encryption and hashing — AES, DES, Triple DES, RC4, and RSA alongside the full hash family: MD5, the SHA variants, HMAC, and more. Not toy versions — the actual algorithms with keys, IVs, and modes.
• JWT decode, verify, and sign — Inspect a token's claims, check its signature against a secret or key, or mint one. The thing you were about to paste into a public JWT tool, done locally.
• The Magic operation — Point it at data you don't recognise and it detects likely encodings, chains them, and shows you what falls out. It's the "I don't even know what this is" button.
• Format conversion and compression — JSON, CSV, and XML back and forth, plus hex dumps, gzip, zlib, bzip2, and raw deflate for packing and unpacking.
• Extractors, regex, and highlighting — Pull every IP, email, or URL out of a blob, run full regular expressions, and see which bytes of input map to which bytes of output.

Drag a file straight in and it processes that too — no upload, just local compute.

Why self-host it instead of the hosted version

CyberChef is client-side even on the public GitHub Pages copy, so let's be straight about what self-hosting actually buys you.

• A tool that's always there, on your terms. The public instance depends on someone else's uptime and a domain your security team may well block. Your own instance lives at an internal URL you control, works on a locked-down or air-gapped network, and is available the day GitHub isn't.
• One instance, no per-seat anything. CyberChef is free and open source. Host it once and the whole team — ten people or a thousand — shares a single internal link. There's no SaaS pricing to negotiate, no seat count to police, no upsell tier where the useful operations live.
• The exact version you trust, behind your own door. Pin a release you've reviewed instead of tracking whatever the public page serves today, put it behind your SSO, and give it your own hostname. For a tool people paste sensitive strings into, knowing precisely what code is running matters.

Who it's for

Three groups get the most out of a hosted CyberChef:

• Security, IR, and SOC analysts who live in encodings and ciphers all day and can't be pasting artefacts into random public sites.
• Developers debugging JWTs, webhook signatures, base64 payloads, and encoding mismatches who want one reliable workbench instead of ten sketchy tabs.
• Ops and compliance teams at shops where pasting data into an external website is a policy violation, full stop — an internal instance makes the whole question moot.

The honest setup notes

CyberChef is one of the easier things to self-host, and we'll be honest about why: there's no database, no SMTP, no user accounts, and almost no resource footprint. It's essentially a bundle of static files that run in the visitor's browser. That said, "easy" isn't "nothing":

• You're serving it yourself. That means a web server, a certificate, and HTTPS set up and kept working — not hard, but yours to own.
• Updates don't happen on their own. New releases add operations and fix bugs; staying current means pulling the new build and redeploying, on your schedule, forever.
• Private means you make it private. CyberChef has no login of its own, so if you don't want it open to the internet, the auth layer in front of it is on you.

None of this is heavy. It's just the ongoing, unglamorous kind of work that turns "I set it up once" into "it still works in a year." Or let us run it.

Deploy it in one click

Rolling your own looks like: clone the repository, install the toolchain, run the build, wire up a web server, provision TLS, put auth in front of it, and set yourself a reminder to redeploy every time a new version ships. Do-able in an afternoon, and then it's a small standing chore on your plate.

On Caliber Node it's one click. We stand up your CyberChef instance on infrastructure we run, hand you a working URL over HTTPS, and keep it patched and online. You get real logs and SFTP access to the files — it's your instance, not a black box — without the build-and-maintain tax. When you want it, deploy CyberChef in one click and it's ready in minutes.

No toolchain, no certificate wrangling, no update calendar.

First run

Your first decode takes about a minute:

1. Open your instance at the URL we give you — CyberChef loads straight into its workbench, no sign-up screen: operations on the left, your recipe in the middle, input and output on the right.
2. Find an operation. Type `From Base64` into the operations search on the left and drag it into the Recipe column in the middle.
3. Paste your input into the Input box. The output bakes automatically as you go.
4. Chain another step. Drag `JSON Beautify` below the first operation to pretty-print what came out — that's a recipe: two operations, one pipeline.
5. Save it. Hit *Save recipe* or copy the URL, which now encodes your whole pipeline, and it's a click away next time.

That's the loop — search, drag, paste, chain, save — and it scales from a one-off decode to a forty-step forensic recipe.

The bigger picture

The quick-decoder habit is so ingrained most of us never notice it's a data-leak habit too. Every one-off paste into a stranger's website is a tiny, repeated decision to trust them with whatever you're looking at — and the stuff you decode is exactly the stuff worth not leaking. Owning the tool flips that. The workbench becomes yours: same powerful operations, none of the paste-and-pray. It's a small piece of your stack to bring in-house, and one you'll touch constantly.

Deploy CyberChef in a few minutes →

Or browse the full app catalog.

One-click self-hosted apps, managed for you — real logs, SFTP, and your data always exportable. Never a black box.