CyberChef

Prerequisites

• An active Azure subscription.
• An SSH key pair, and a VNet and subnet in the target region.
• Standard_B2s (2 vCPU / 4 GiB RAM) is more than enough. CyberChef does all its work in the browser, so the server only serves static files.
• NSG inbound rules: allow 22/tcp from your management network and 80/tcp for the web interface.

CyberChef serves plain HTTP on port 80. For production or shared access, terminate TLS in front of it with your own domain, using a reverse proxy or Azure Application Gateway.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, select Create a resource, search the Marketplace for CyberChef by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM and open port 80:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:cyberchef-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name cyberchef \
  --image sac1647283583153:cyberchef-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name cyberchef --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH with the administrator account you created:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

nginx serves CyberChef on port 80. A one-shot cyberchef-firstboot.service runs once on first boot to record the access URL. Confirm that both units are active and that nginx is listening on port 80:

systemctl is-active nginx cyberchef-firstboot
sudo ss -tlnp | grep ':80 '

Expected output:

active active LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=...)) LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=...))

Step 5 - Confirm the app is served

nginx serves an unauthenticated /healthz endpoint for load balancer probes and the CyberChef single-page app at /. Confirm that the health endpoint returns 200, the served page is CyberChef, and the JavaScript bundle loads:

curl -sI http://127.0.0.1/healthz | head -1
curl -s http://127.0.0.1/ | grep -o '<title>[^<]*</title>'
curl -s -o /dev/null -w 'assets/main.js -> HTTP %{http_code}\n' http://127.0.0.1/assets/main.js

Expected output:

HTTP/1.1 200 OK <title>CyberChef</title> assets/main.js -> HTTP 200

Step 6 - Inspect the static bundle on disk

The whole appliance is the official CyberChef release, extracted into a single docroot. The entry HTML is published as index.html, next to the assets/, images/ and modules/ directories:

ls -1 /var/www/cyberchef | head -12 du -sh /var/www/cyberchef

Expected output:

ChefWorker.js.LICENSE.txt CyberChef_v11.2.0.html ... assets images index.html modules 72M /var/www/cyberchef

Step 7 - Read the per-VM access note

CyberChef has no login, so there is no password to retrieve. On the first boot of every VM, cyberchef-firstboot.service resolves the VM's address and writes a short access note to a root-only file. The note tells you where to point your browser:

sudo cat /root/cyberchef-info.txt

Expected output:

# CyberChef appliance by sac - access information
#
# CyberChef is 'The Cyber Swiss Army Knife': a purely client-side web app. There is no
# login, no account and no server-side data - every operation runs in your own browser.
# Open the URL below in a web browser to start using it. cyberchef_url=http://<vm-ip>/

The note records the VM's own address. To reach CyberChef from your workstation, use the VM's public IP address or DNS name.

Step 8 - Open CyberChef and decode Base64

Browse to http://<vm-public-ip>/. CyberChef opens with four panes: the Operations list on the left, the Recipe you are building, the Input you want to transform, and the computed Output.

Drag From Base64 from the Operations list into the Recipe. Paste a Base64 string such as Q3liZXJDaGVmIG9uIFVidW50dSAyNC4wNCBieSBjbG91ZGltZw== into Input. The decoded text appears in Output immediately, because auto bake is on by default.

Step 9 - Encode data with To Base64

Recipes work in both directions. Add To Base64 to the Recipe, type any plain text into Input, and CyberChef encodes it to Base64 in the Output pane.

You can chain operations by stacking them in the Recipe. For example, decode from one format and re-encode into another.

Step 10 - Convert data to hex

Add the To Hex operation to view any input as a space-delimited hex dump. This is useful for inspecting bytes, control characters or binary data.

Change the delimiter and bytes-per-line options in the operation to match the format you need.

Step 11 - Compute a SHA2-256 hash

CyberChef includes a full set of hashing and checksum operations. Add SHA2 with size 256, then type or paste your input. The browser computes the digest and shows it in Output, and no data leaves your machine.

The same pattern works for MD5, SHA1, SHA3, CRC checksums and HMAC.

Maintenance

• Nothing to back up: CyberChef stores no data. Every operation runs in the browser, and nothing is persisted on the server, so the appliance is entirely stateless.
• Updating CyberChef: the release is pinned by sha256 for reproducibility. To move to a newer release, download the official release bundle from the CyberChef releases page and extract it into /var/www/cyberchef. Then publish its entry HTML as index.html.
• Security updates: unattended security upgrades are enabled, so the OS keeps itself patched. Reboot when a new kernel is installed.
• TLS and access control: for shared or production use, front CyberChef with your own domain and a TLS-terminating reverse proxy or Azure Application Gateway. Restrict port 80 in the NSG to the networks that need it.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image. Contact sales@secureanycloud.com.

CyberChef is Crown Copyright and licensed under the Apache License 2.0. SecureAnyCloud provides this image, which is not affiliated with or endorsed by GCHQ. Additional charges apply for build, maintenance and 24/7 support.

Deploy on Azure

Launch CyberChef on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Connecting to your instance

Connect over SSH on port 22 with your EC2 key pair. The login user depends on the operating system variant you launched:

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh ubuntu@<instance-public-ip>

The recommended instance type is m5.large (2 vCPU / 8 GiB RAM), which is comfortably more than enough. CyberChef does all its work in the browser, so the server only serves static files.

Step 1 - Launch from AWS Marketplace

Find the CyberChef - The Cyber Swiss Army Knife - AMI by SecureAnyCloud listing on AWS Marketplace. Choose Continue to Subscribe, then Continue to Configuration, then Continue to Launch.

Pick your region, instance type (m5.large), key pair, VPC and subnet. For the security group, open 22/tcp (SSH) from your management network and 80/tcp (HTTP) from the networks that should reach CyberChef.

Launch the instance and note its public IPv4 address.

Step 2 - Confirm the services are running

nginx serves CyberChef on port 80. A one-shot cyberchef-firstboot.service runs once on first boot to record the access URL. Confirm that both units are active and that nginx is listening on port 80:

systemctl is-active nginx cyberchef-firstboot
sudo ss -tlnp | grep ':80 '

Expected output:

active active LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=...)) LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=...))

Step 3 - Confirm the app is served

nginx serves an unauthenticated /healthz endpoint for load balancer probes and the CyberChef single-page app at /. Confirm that the health endpoint returns 200, the served page is CyberChef, and the JavaScript bundle loads:

curl -sI http://127.0.0.1/healthz | head -1
curl -s http://127.0.0.1/ | grep -o '<title>[^<]*</title>'
curl -s -o /dev/null -w 'assets/main.js -> HTTP %{http_code}\n' http://127.0.0.1/assets/main.js

Expected output:

HTTP/1.1 200 OK <title>CyberChef</title> assets/main.js -> HTTP 200

Step 4 - Inspect the static bundle on disk

The whole appliance is the official CyberChef release, extracted into a single docroot. The entry HTML is published as index.html, next to the assets/, images/ and modules/ directories:

ls -1 /var/www/cyberchef | head -12 du -sh /var/www/cyberchef

Expected output:

ChefWorker.js.LICENSE.txt CyberChef_v11.2.0.html ... assets images index.html modules 72M /var/www/cyberchef

Step 5 - Read the per-instance access note

CyberChef has no login, so there is no password to retrieve. On the first boot of every instance, cyberchef-firstboot.service resolves the instance's public address from EC2 instance metadata and writes a short access note to a root-only file. The note tells you where to point your browser:

sudo cat /root/cyberchef-info.txt

Expected output:

# CyberChef appliance by sac - access information
#
# CyberChef is 'The Cyber Swiss Army Knife': a purely client-side web app. There is no
# login, no account and no server-side data - every operation runs in your own browser.
# Open the URL below in a web browser to start using it. Because there is no login, restrict
# who can reach it at the network edge (security group, VPN or authenticating reverse proxy). cyberchef_url=http://<instance-public-ip>/

To reach CyberChef from your workstation, use the instance's public IP address or DNS name.

Step 6 - Open CyberChef

Browse to http://<instance-public-ip>/. CyberChef opens with four panes: the searchable Operations catalogue on the left (481 operations), the Recipe you are building, the Input you want to transform, and the computed Output.

There is no sign-in step. The tool loads immediately.

Step 7 - Build a recipe

Drag an operation from the Operations catalogue into the Recipe, then type or paste your data into the Input pane. With Auto Bake on (the default), the Output updates as you go.

For example, a To Base64 operation encodes a line of plain text into Base64 in the Output pane. This happens in the browser, and nothing is sent to the server.

Operations stack, so you can chain several into a repeatable recipe. For example, decode from one format and re-encode into another. Save or share the recipe from the Recipe toolbar.

Step 8 - Explore the operations

CyberChef ships more than 400 operations, grouped into categories such as Data format, Encryption / Encoding, Hashing, Compression, Networking and Forensics. Expand a category, or use the search box, to find what you need.

The Encryption / Encoding category alone includes AES, Blowfish, DES, Triple DES and many more. You can encrypt and decrypt with a key entirely in your browser.

Restricting access

CyberChef ships with no login because it holds nothing sensitive server-side. Every operation runs in the visitor's browser, and no input is uploaded or stored. The instance therefore serves the tool openly on port 80.

To control who can reach the tool, restrict access at the network edge in whichever way suits you:

• Security group: narrow the inbound rule for port 80 to the source IP ranges (your office, VPN or bastion) that should have access, instead of 0.0.0.0/0.
• VPN or private subnet: place the instance in a private subnet and reach it over a VPN or bastion host, with no public IP at all.
• Authenticating reverse proxy: front CyberChef with a reverse proxy (nginx, Caddy, an Application Load Balancer with authentication, or an identity-aware proxy) that requires sign-in and terminates TLS for your own domain.

CyberChef serves plain HTTP on port 80. For production or shared access, terminate TLS in front of it with your own domain, using one of the reverse-proxy options above.

Maintenance

• Nothing to back up: CyberChef stores no data. Every operation runs in the browser, and nothing is persisted on the server, so the appliance is entirely stateless.
• Updating CyberChef: the release is pinned by sha256 for reproducibility. To move to a newer release, download the official release bundle from the CyberChef releases page and extract it into /var/www/cyberchef. Then publish its entry HTML as index.html.
• Security updates: keep the OS patched with sudo apt-get update && sudo apt-get upgrade. Reboot when a new kernel is installed.
• TLS and access control: for shared or production use, front CyberChef with your own domain and a TLS-terminating reverse proxy. Restrict port 80 in the security group to the networks that need it.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image. Contact sales@secureanycloud.com.

CyberChef is Crown Copyright and licensed under the Apache License 2.0. SecureAnyCloud provides this image, which is not affiliated with or endorsed by GCHQ. Additional charges apply for build, maintenance and 24/7 support.

Deploy on AWS

Launch CyberChef with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com