cchef

CyberChef on the command line. cchef is a Go port of the data-transformation engine of CyberChef — the "Cyber Swiss Army Knife" built for the terminal.

Every operation is a subcommand that reads input and writes output, so operations chain together through Unix pipes or as a single recipe, and any recipe can be turned into a shareable CyberChef URL.

Install

Homebrew (macOS and Linux) — also installs the man page and completions:

brew install roberson-io/tap/cchef

Debian / Ubuntu (.deb) and Fedora / RHEL (.rpm) — these fetch whatever the latest release is; use linux_arm64 on 64-bit Arm:

curl -LO "$(curl -fsSL https://api.github.com/repos/roberson-io/cchef/releases/latest \
  | grep -o 'https://[^"]*linux_amd64\.deb"' | tr -d '"')"
sudo dpkg -i cchef_*_linux_amd64.deb

curl -LO "$(curl -fsSL https://api.github.com/repos/roberson-io/cchef/releases/latest \
  | grep -o 'https://[^"]*linux_amd64\.rpm"' | tr -d '"')"
sudo rpm -i cchef_*_linux_amd64.rpm

Windows — with Scoop:

scoop bucket add roberson-io https://github.com/roberson-io/scoop-bucket
scoop install cchef

…or from the zip, which also carries the man page, docs and PowerShell completions:

$Url = (Invoke-RestMethod https://api.github.com/repos/roberson-io/cchef/releases/latest).assets |
  Where-Object name -like '*windows_amd64.zip' |
  Select-Object -ExpandProperty browser_download_url
Invoke-WebRequest -Uri $Url -OutFile cchef.zip
Expand-Archive cchef.zip -DestinationPath $env:LOCALAPPDATA\cchef

Then add %LOCALAPPDATA%\cchef to your PATH.

With Go (Go 1.27+; installs no man page or completions):

go install github.com/roberson-io/cchef@latest

From source:

make build      # produces ./dist/cchef

The result is a single static binary with no cgo; the only optional runtime dependency is tesseract, for the Optical Character Recognition operation.

Shell completion is built in — cchef completion bash|zsh|fish|powershell prints a script. Homebrew and the deb/rpm packages install the bash, zsh and fish scripts for you; the PowerShell one ships in the Windows archive.

See docs/install.md for per-platform detail, what each package installs where, uninstalling, and verifying a release (checksums, cosign signature, SLSA provenance and SBOMs).

Quickstart

An operation reads from a positional argument, -i, --in-file, or stdin — all three of these print aGVsbG8=:

cchef to-base64 "hello"

cchef to-base64 -i "hello"

echo -n "hello" | cchef to-base64

Chain operations with pipes (61 47 56 73 62 47 38 3d):

cchef to-base64 "hello" | cchef to-hex

Hash something:

cchef sha256 -i 'Hello, World!'

Run a whole recipe at once (JSON or compact "Chef" format):

cchef bake -e "To_Base64()To_Hex()" "hello"

Work out what unknown data is, and how to decode it:

cchef magic -i "41 42 43 44 45"

Turn a recipe into a CyberChef share URL:

cchef url -e "ROT13()" -i "hello"

Discover what's available — every operation grouped by category with a one-line summary — and note that common operations have short aliases (b64e runs to-base64):

cchef list
cchef b64e "hello"

Process a whole directory of files (CyberChef's folder input):

cchef to-base64 --in-dir ./messages
cchef to-base64 --in-dir ./messages --out-dir ./out --recursive

A trailing newline is added only when writing to a terminal. Operations accept --in-file - / --output - to force stdin/stdout in a pipeline.

Point an operation (or bake) at a directory with --in-dir to run it once per file — top-level by default, --recursive to walk subdirectories. Results go to stdout with ==> name <== headers, or to --out-dir as one output file per input; a file whose recipe fails is reported and skipped (non-zero exit).

Operations

Operations are grouped using the same categories as CyberChef. Each page documents every operation's options, examples and reference links:

Category	Covers
Arithmetic / Logic	Sum, Subtract, Multiply, Divide, Mean, Median, Standard Deviation, MOD, Extended GCD, Modular Exponentiation, Modular Inverse, and the set operations
Code tidy	Beautify and minify for JavaScript, CSS, SQL, XML and JSON; PHP and BSON serialization; JPath, XPath, jq and CSS selectors; case conversion
Compression	Gzip, Zlib, Raw Deflate, Bzip2, LZMA, LZ4, LZNT1, LZString, XPRESS, Zip and Tar
Data format	Base32/45/58/62/64/85/92, Hex, Binary, Octal, Decimal, Charcode, BCD, Float, Hexdump, Braille, Punycode, COBS, MessagePack, CBOR, Avro, YAML, ASN.1, TLV, URL and HTML entity encoding
Date / Time	UNIX and Windows timestamps, DateTime parsing, formatting and deltas
Encryption / Encoding	AES, DES, Triple DES, Blowfish, Twofish, RC2, RC4, RC6, ChaCha, Salsa20, Rabbit, TEA, XTEA, XXTEA, SM4, PRESENT, GOST, Ascon, Fernet, JWT; the classical ciphers; the Bletchley Park machines (Enigma, Bombe, Lorenz, Colossus, Typex, SIGABA); and the bitwise operations
Extractors	Pull IPs, URLs, domains, email addresses, file paths, hashes, dates, EXIF, ID3 and embedded files out of data; regular expressions, RAKE and Jsonata
Flow control	Fork, Merge, Subsection, Jump, Conditional Jump, Label, Register, Return, Comment, and Magic
Forensics	Detect File Type, Scan for Embedded Files, ELF Info, YARA Rules, and the steganography operations
Hashing	MD2/4/5, SHA-0/1/2/3, Keccak, Shake, BLAKE2/3, RIPEMD, Whirlpool, Streebog, SM3, Ascon, HMAC, CMAC, bcrypt, scrypt, Argon2, CRC and the fuzzy hashes
Language	Character-encoding conversion, Unicode escapes and formatting, diacritics, NATO alphabet and Leet Speak
Multimedia	Image resizing, cropping, filtering and format conversion; EXIF; audio metadata; QR codes
Networking	IP address arithmetic and formats, CIDR, MAC addresses, URI parsing, HTTP, DNS-over-HTTPS, TLS/JA3 and user agents
Other	Entropy, frequency and hash analysis, sequence and password generators, HTML rendering, Numberwang
Public Key	RSA, ECDSA and PGP; X.509 certificates and CSRs; key generation, signing and verification
Utils	Sorting, filtering, unique, find and replace, padding, escaping, unit and coordinate conversion, diff, file trees

Flags and options are aliased to support both US and UK spellings: analyze-hash runs analyse-hash, --color sets --colour, and Grayscale selects Greyscale. See British and American spellings.

See docs/ for the full documentation index, and docs/recipes-and-urls.md for bake, url, and recipe convert.

Recipes

A recipe is an ordered list of operations, expressible in two formats (auto-detected):

• JSON: [{"op":"To Base64","args":["A-Za-z0-9+/="]}, ...]
• Chef (compact): To_Base64('A-Za-z0-9+/=')To_Hex('Space')

Run one with cchef bake -e <recipe> / -r <file>, convert between formats with cchef recipe convert, or share it with cchef url.

A CyberChef share link works in both directions — cchef url writes one, and --from-url reads the recipe (and any input) back out of one, offline:

cchef bake --from-url "https://gchq.github.io/CyberChef/#recipe=ROT13()&input=aGVsbG8"

A recipe can also be built up interactively, one operation at a time. The staged recipe lives in .cchef-recipe.json in the working directory, and bake, url and recipe convert all use it when given no recipe of their own:

cchef recipe add "To_Base64()"
cchef recipe add "To_Hex('Space')"
cchef recipe show
cchef bake "hello"

show lists the staged steps numbered, each marked [X] when it runs or [ ] when it is disabled; rm, move and toggle edit them by number, and clear discards the recipe. load replaces the whole staged recipe with one from a file, string or share link, and recipe convert prints it back out. See cchef recipe add and friends.

Use as a Go library

The engine is importable, so a Go program can bake recipes without shelling out. core is the engine; importing ops for its side effects registers every operation.

go get github.com/roberson-io/cchef

import (
    "github.com/roberson-io/cchef/core"
    _ "github.com/roberson-io/cchef/ops" // register the operations
)

r, err := core.ParseRecipeConfig(`[{"op":"To Base64"}]`)
out, err := r.Execute(core.NewDish([]byte("hello"), core.TypeByteArray))
// out.String() == "aGVsbG8="

An operation can also be named directly, which the compiler checks where a lookup by name cannot:

op := ops.ToBase64{}
out, err := op.Run(core.NewDish([]byte("hello"), core.TypeByteArray),
    core.DefaultArgs(op.Args()))

Implement core.Operation and pass it to core.Register to add an operation of your own; it is then usable by name in any recipe, alongside the built-in ones.

Contributing

Bug reports and pull requests are welcome — see CONTRIBUTING.md for how to set up a development environment and what changes are expected to meet.

AI Disclosure

Most of this codebase — implementation, tests, and documentation — was written with Claude Code, Anthropic's AI coding agent, directed and reviewed by the maintainer, who makes every commit.

AI output is treated as untrusted until verified: operations are tested against CyberChef's own fixtures or checked byte for byte against a running CyberChef instance, and every change passes the full CI gate. If you find something that verification missed, please open an issue.

License

Released under the Apache License 2.0. Attribution for the upstream project and for third-party material included here is in NOTICE.

Credits

cchef is an independent port of CyberChef by GCHQ (Crown Copyright, Apache-2.0). All operation semantics and test vectors derive from that project. cchef is not affiliated with or endorsed by GCHQ.