Executes a multi-stage sequential data transformation pipeline ('recipe') on the input string, chaining multiple operations such as Base64, Hex, URL decoding, XOR, ROT13, and hashing in a single turn. Use this tool when dealing with layered obfuscation or when an automated pipeline is needed to fully unwrap nested attack payloads without requiring multiple LLM conversational rounds.

Performs heuristic forensic analysis on suspicious, unknown, or obfuscated strings to detect encoding formats (Base64, Hex, URL encoding), hash signatures (MD5, SHA1, SHA256), ciphers, and compression. Returns identified patterns, confidence scores, and recommended CyberChef recipes to deobfuscate the data.

Searches the built-in CyberChef operations catalog to find available tools, supported recipe names, and operation capabilities by keyword or category.

Decodes standard RFC 4648 or URL-safe Base64 encoded strings into readable UTF-8 plaintext. Automatically strips whitespace and handles padding.

Encodes arbitrary text or byte data into standard RFC 4648 or URL-safe Base64 string representation.

Converts a hexadecimal byte string back into UTF-8 text or raw character data. Supports raw contiguous hex, space-separated bytes, 0x prefixes, and comma delimiters.

Converts UTF-8 text or character data into its hexadecimal byte representation with optional custom delimiter formatting.

Decodes percent-encoded URL query strings and path segments into standard UTF-8 characters, restoring special characters and spaces.

Encodes reserved and unsafe characters in a string into standard percent-encoded format (%XX) for safe transmission in URLs.

Applies the ROT13 substitution cipher or an arbitrary Caesar cipher shift to alphabetic characters while preserving case and non-alphabet symbols.

Applies a bitwise XOR cipher using a repeating key against the input string. Frequently used in malware analysis, shellcode obfuscation, and CTF challenges. Applying XOR twice with the same key restores the original plaintext.

Identifies probable cryptographic hash algorithms for a given digest based on character set, bit length, and structural signatures (such as MD5, SHA-1, SHA-256, NTLM, bcrypt).

Calculates the cryptographic SHA-256 (Secure Hash Algorithm 256-bit) digest of the input string and returns the resulting 64-character hexadecimal checksum.

Calculates the Shannon entropy (randomness in bits per symbol) of the input data to determine whether it is plaintext, compressed data, packed shellcode, or high-entropy encrypted ciphertext. Provides representation-calibrated analysis for Hex (max 4.0 bits/char) and Base64 (max 6.0 bits/char).

Decodes and inspects JSON Web Tokens (JWT) without requiring a signature secret. Parses and validates the Jose header, claims payload, algorithm specifications, expiration dates, and detects dangerous 'none' algorithms.

Sanitizes malicious or suspicious URLs into a defanged representation (e.g. converting 'http' to 'hxxp' and '.' to '[.]') to prevent accidental clicks while preserving the domain for security reporting.

Scans unstructured text, logs, memory dumps, or decompiled scripts to automatically extract security entities including IPv4 addresses, URLs, and email addresses.