01 · Product name
CyberChef
Free GCHQ web app for encoding and hashing.
Published by GCHQ.
In short
CyberChef is the free web application in gchq/CyberChef for encryption, encoding, compression, and data analysis. On 21 Oct 2026 the GitHub API reported 36,172 stars and 4,181 forks, and the SPDX field was Apache-2.0. The latest release was v11.5.0, published 18 Sep 2026. The repository was pushed 19 Oct 2026. The app runs in the browser at gchq.github.io/CyberChef. Metadata and files is the nearest category, and the fit is weak: CyberChef transforms bytes you paste. It does not read the metadata tags ExifTool prints.
Product pricing strategy
02
Free
CyberChef is free. The GitHub SPDX field on 21 Oct 2026 was Apache-2.0, and neither the repository nor the v11.5.0 release printed a dollar price. The hosted page at gchq.github.io/CyberChef does not show a checkout. The 13,647 figure is the API's download count for the release zip, not a fee and not a count of hosted-page visitors. Security Onion includes CyberChef and is itself described as free and open. That bundle does not add a CyberChef price. There is no paid tier on the pages opened for this listing. If a course or a book teaches CyberChef, its price belongs to that course. It was not on the repository.
Utility and features
03
The GitHub description calls CyberChef a web app for encryption, encoding, compression, and data analysis. The homepage field is https://gchq.github.io/CyberChef. The API response on 21 Oct 2026 listed license SPDX Apache-2.0, 36,172 stars, 4,181 forks, default branch master, and pushed_at 2026-10-19T04:15:56Z. Release v11.5.0 was published 2026-09-18T11:54:19Z by github-actions. The release notes point at CHANGELOG.md and the commit messages. The zip asset name is CyberChef_8cd426dd4f40f1423912d5fad91b578a86a65112.zip, and the API reported 13,647 downloads of that asset. That download count is the release asset's, not a count of people who use the hosted page.
- Apache-2.0 on GitHub. The API license field on 21 Oct 2026 was Apache-2.0. Stars were 36,172 and forks were 4,181.
- v11.5.0 on 18 Sep 2026. The latest release was published 18 Sep 2026. The repository push time was 19 Oct 2026. They are different events.
- Hosted app, no checkout. gchq.github.io/CyberChef is the homepage field. No price was printed there or on the release.
The hosted app takes a recipe and an input and shows the output in the browser. A local copy can be opened from the release zip. Security Onion's GitHub description names CyberChef among the tools that distribution includes. That is a bundle, not a second upstream. No price was printed on the repository or the release. The organization is gchq. This listing does not invent a support contract.
- 1
Cite v11.5.0 as the latest release and 19 Oct 2026 as the push time. Do not merge them into a new version.
- 2
Run a recipe on data you are allowed to transform, on the official host or a local copy of the zip.
- 3
Read the output as the recipe's result. It does not identify an author.
Caveats
04
Apache-2.0 is the SPDX field. The release tag is v11.5.0, published 18 Sep 2026, while the repository push time is 19 Oct 2026. A push is not a new release. Do not call the October push v11.5.1 or any version the API did not list as latest.
The app shows the output of the recipe you chose. It does not decide that a decoded string is true, current, or written by a particular person. Metadata and files is the nearest category, and the fit is weak. ExifTool reads tags stored in a file. CyberChef does not. Pasting a secret, a password, or a private key into a third-party copy of the page publishes it to that copy. Prefer the official host or a local zip when the input is sensitive. A recipe that decrypts a file you are allowed to open is a transform. It is not a method for breaking into a system.
Screenshots
05
Potential use cases
06
- The October push is about to be called a new release. On 21 Oct 2026 the GitHub API said gchq/CyberChef was pushed at 2026-10-19T04:15:56Z. The latest release was v11.5.0, published 18 Sep 2026. Stars were 36,172 and forks were 4,181. The SPDX field was Apache-2.0. Cite the release for the version and the push time for the later commit.
- A sensitive string is about to be pasted into an unofficial copy of the page. The homepage field is https://gchq.github.io/CyberChef, and the release publishes a zip. Use the official host or a local copy of that zip when the input matters. The API's 13,647 downloads count the release zip, not visitors to the hosted page.
- The output pane is about to be briefed as metadata or as an identity. Metadata and files is the nearest category, and the fit is weak. ExifTool reads tags in a file. CyberChef shows the result of a recipe. A decoded string is not an author, and it is not proof the input was what a person claims.
Hard cases
The case where the first result is easy to over-read.
The October push becomes v11.5.1
The API's latest release tag was v11.5.0 on 18 Sep 2026. A push on 19 Oct 2026 does not mint a version number. Calling the tree v11.5.1, or dating v11.5.0 to October, merges two fields the API keeps apart.
Practitioners using it
Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.
I joined the @HSC_Consult 3rd Internship Cohort and completed my first SOC investigation task. I used Kali “jq” + CyberChef to detect a fileless PowerShell attack, uncover persistence via scheduled tasks, and decode the attacker’s payload. Real hands-on experience. #BlueTeam pic.twitter.com/4UOgCZs054
Day 65 I completed Phishing Analysis Fundamentals room on TryHackMe, learning all the components that make up an email. Worked through phishing emails, checked headers, investigated suspicious URLs/IPs, and used CyberChef to decode and defang indicators. #Cybersecurity #Phishing pic.twitter.com/6evktrokZR
Questions
Is CyberChef free?
Yes. The GitHub SPDX field was Apache-2.0 on 21 Oct 2026, and no price was printed on the repository, the release, or the hosted app.
Which version is current?
The latest GitHub release was v11.5.0, published 18 Sep 2026. The repository was pushed 19 Oct 2026. The push is not a newer version number.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
CyberChef web app
https://gchq.github.io/CyberChefDocumentation
CyberChef repository
https://github.com/gchq/CyberChefDocumentation
CyberChef v11.5.0
https://github.com/gchq/CyberChef/releases/tag/v11.5.0