Executes a multi-stage sequential data transformation pipeline ('recipe') on the input string across 28 core CyberChef operations (Base64, Hex, URL, HTML entities, XOR, ROT13, AES-CBC Encrypt/Decrypt, MD5, SHA1, SHA256, SHA512, Entropy, Magic, JWT, Defang, Dual-stack IP, DLP entities, Strings, JSON Beautify, Regex, Reverse, Find/Replace). Limits: 5000ms execution timeout, 10MB memory cap per recipe.

Performs heuristic forensic analysis on suspicious or obfuscated strings to detect encoding formats (Base64, Hex, URL encoding), hash signatures (MD5, SHA1, SHA256), ciphers, and compression. Returns detected patterns, confidence scores, and recommended CyberChef recipes.

Searches the built-in catalog of 28 core CyberChef operations to find available tools, supported recipe names, and operation parameters by keyword or category.

Decodes RFC 4648 standard or URL-safe Base64 encoded strings and returns structured output { utf8, hex, isPrintable, byteLength }. Crucial: Distinguishes printable text from raw binary ciphertext/TOTP secrets without mojibake data corruption.

Encodes arbitrary text or byte data into standard RFC 4648 or URL-safe Base64 string representation.

Converts a hexadecimal byte string into character data and returns structured output { utf8, hex, isPrintable, byteLength }. Supports raw hex, space-separated bytes, 0x prefixes, and comma delimiters.

Converts UTF-8 text or character data into its hexadecimal byte representation with optional custom delimiter formatting.

Decodes percent-encoded URL query strings and path segments into standard UTF-8 characters.

Encodes reserved and unsafe characters in a string into standard percent-encoded format (%XX) for safe URL transmission.

Applies the ROT13 substitution cipher or an arbitrary Caesar cipher shift to alphabetic characters while preserving case and non-alphabet symbols.

Applies a bitwise XOR cipher using a repeating key against the input string. Preserves raw binary bytes without UTF-8 corruption. Running XOR twice with the same key restores original plaintext.

Identifies probable cryptographic hash algorithms for a given digest based on character set, bit length, and structural signatures. Supports modern password hashes (Argon2id/i/d, scrypt, PBKDF2) with OWASP parameter audits, full bcrypt prefixes ($2$, $2a$, $2b$, $2x$, $2y$), and ranked confidence for hex digests (MD5 vs NTLM vs MD4). Note: Classifies format; does not crack hashes.

Calculates the cryptographic SHA-256 digest of the input string and returns the resulting 64-character hexadecimal checksum.

Calculates Shannon entropy and saturation against the input alphabet ceiling (Hex max 4.0 bits/char, Base64 max 6.0 bits/char, Raw max 8.0 bits/char). Reports bitsPerChar, maxForAlphabet, normalizedRatio, and totalBits to accurately determine whether data is plaintext, compressed, packed shellcode, or high-entropy ciphertext.

Decodes and inspects JSON Web Tokens (JWT) without requiring a signature secret. Parses and validates the Jose header, claims payload, algorithm specifications, expiration dates, and detects dangerous 'none' algorithms.

Sanitizes malicious URLs, domains, IPv4 addresses, and email addresses for safe display and reporting. Scoped: defangs protocol (hxxp/hxxps), defangs hostnames and IP dots while preserving path and query string decimals, and converts email '@' to '[at]'.

Enterprise DLP and forensic entity scanner. Extracts and redacts: Credit Cards (with Luhn check), US SSN, India PAN, IBAN, E.164 phone numbers, strict dual-stack IPv4 (validating 0-255 octet range; rejects 999.999.999.999) and IPv6, AWS access keys, JWTs, private keys, URLs, and emails. Returns match type, offset, and masked preview to preserve privacy.

Automated one-shot security triage for autonomous AI agents (Strix, Claude, Cursor). In a single turn, checks an unknown or suspicious string for DLP/PII leaks, calculates alphabet-calibrated entropy, attempts magic recipe detection, and produces actionable severity findings and remediation steps.