CYBERCHEF DEOBFUSCATION RECIPE STUDIO

v4.8 ENGINE

Multi-step cryptographic & encoding pipeline for reversing obfuscated payloads, C2 streams, and shellcode.

Malware Recipes:

Operations Palette13 Available

Base64 Decode

Decodes RFC 4648 Base64 data with UTF-8, ASCII, or UTF-16LE support.

Encodings & Formats

Base64 Encode

Encodes input bytes into Base64 format.

Encodings & Formats

Hex to ASCII (From Hex)

Parses hex-encoded byte streams into raw characters or text.

Encodings & Formats

To Hex

Converts text or binary data into hexadecimal representation.

Encodings & Formats

XOR Brute-Force / Key

Single-byte or multi-byte XOR decryption with interactive slider key.

Ciphers & Decryption

RC4 Decryption

Rivest Cipher 4 stream cipher decryption with passphrase.

Ciphers & Decryption

AES-128 Decryption

Symmetric AES-128 (CBC/ECB) block cipher decryption.

Ciphers & Decryption

ROT13 / Caesar Cipher

Rotates alphabetic characters by a specified offset (1-25).

Ciphers & Decryption

URL Unquote / Decode

Decodes %XX percent-encoded URLs and PowerShell strings.

Encodings & Formats

Reverse

Reverses character order or byte sequence.

String Operations

Gzip / Zlib Decompress

Decompresses gzip, zlib, or deflate payload archives.

Compression & Obfuscation

Find & Replace

Substitutes matching strings or regular expressions.

String Operations

Strip Whitespace / Null Bytes

Cleans out spaces, newlines, and 0x00 null padding.

String Operations

Recipe Pipeline

2 of 2 active steps

0.47ms

1Hex to ASCII (From Hex)

2RC4 Decryption

Passphrase:UTF-8

Input Payload194 chars / 194 bytes

Deobfuscated Output

Entropy:5.16 / 8.0

[{"host":"DESKTOP-VICTIM7","domain":"CORP-DOM","app":"Google Chrome","url":"https://accounts.google.com","user":"admin@corp.local","pass":"P@ssw0rd2026!","exfil_timestamp":"2026-08-24T03:12:00Z"}]