👨🍳 TryHackMe — CyberChef: The Basics | Learning Guide
Platform: TryHackMe Room: CyberChef: The Basics Path: Cyber Security 101 → Defensive Security Tooling Estimated Time: 60 Minutes Status: Completed ✅
Spoiler-Free Learning Guide: This article contains no TryHackMe flags, challenge-file answers, or direct task solutions. It focuses on CyberChef concepts, methodology, operations, recipes, and hands-on examples using independent sample data.
Introduction
After learning about networking, Windows, command-line tools, and SIEM, I moved on to a tool that appears repeatedly across cybersecurity tasks:
CyberChef
CyberChef is often described as the:
Swiss Army knife of cybersecurity
It is a browser-based application that can perform a huge variety of data transformations without requiring us to write scripts for every small task.
Some examples include:
Base64 encoding / decoding
Hex conversion
URL encoding / decoding
ROT13
Binary conversion
Hashing
Encryption / decryption
Extracting IP addresses
Extracting email addresses
Extracting URLs
Working with timestamps
What makes CyberChef especially useful is that these operations can be combined into recipes.
For example:
Input
↓
From Base64
↓
From Hex
↓
ROT13
↓
Output
Instead of manually using three different websites or scripts, CyberChef can perform the whole sequence inside one interface.
TryHackMe's room introduces what CyberChef is, how to navigate its four main areas, how operations and recipes work, and how to apply common transformations and extractors. (TryHackMe)
The room follows this structure:
Introduction
↓
Accessing the Tool
↓
Navigating the Interface
↓
Thinking Before Cooking
↓
Practice
↓
Your First Official Cook
↓
Conclusion
Task 1 — Introduction
The first task introduces CyberChef as a general-purpose data transformation tool.
Cybersecurity regularly involves encountering data that does not immediately make sense.
For example:
SGVsbG8gV29ybGQ=
or:
48 65 6c 6c 6f
or:
https%3A%2F%2Fexample.com
These may initially appear unreadable, but they represent data encoded in different ways.
Instead of manually converting each format, CyberChef provides operations specifically designed for these tasks.
The Main CyberChef Idea
The workflow is:
DATA
↓
OPERATION
↓
RESULT
For example:
Text
↓
To Base64
↓
Base64-encoded text
But CyberChef becomes more powerful when several operations are chained:
Input
↓
Operation 1
↓
Operation 2
↓
Operation 3
↓
Final Output
This chain is called a:
Recipe
CyberChef officially describes recipes as a sequence of operations executed in order. (TryHackMe)
Why CyberChef Is Useful in Cybersecurity
CyberChef can help when working with:
Incident-response logs
Suspicious strings
Encoded URLs
Email artifacts
Malware indicators
Network data
CTF challenges
Forensic evidence
Obfuscated data
For example, an analyst might encounter:
Encoded PowerShell
or:
An unfamiliar hexadecimal string
or:
A block of text containing many IP addresses
CyberChef allows that data to be transformed or extracted quickly.
🛠️ Hands-On — Task 1
Tools Used
CyberChef
Web Browser
TryHackMe Room
A simple independent example:
Input:
Cyber Security
Apply:
To Base64
The output becomes an encoded representation.
Then add:
From Base64
after it.
The complete recipe becomes:
Cyber Security
↓
To Base64
↓
From Base64
↓
Cyber Security
This simple example demonstrates an important principle:
Operations are executed from top to bottom in the recipe.
Task 2 — Accessing the Tool
CyberChef does not require a complicated installation process.
TryHackMe introduces two convenient ways to use it:
Online
or
Local / Offline
Online CyberChef
The easiest option is the browser version.
Conceptually:
Browser
↓
CyberChef
↓
Paste Input
↓
Create Recipe
↓
Get Output
This is useful when working with ordinary training data.
Offline CyberChef
CyberChef can also be downloaded and run locally.
This is important from a security perspective.
Imagine working with:
Sensitive incident logs
Confidential company data
Malware samples
Private forensic evidence
Uploading sensitive material to random online services may be inappropriate.
A local CyberChef copy allows processing to remain on the analyst's own machine.
Security Lesson
Whenever using online tools, I should ask:
Is this data safe to paste into a third-party website?
For public training data:
Usually fine
For confidential corporate evidence:
Think carefully
Offline tooling may be safer.
🛠️ Hands-On — Task 2
Tools Used
Web Browser
Online CyberChef
Offline CyberChef option
My workflow was simply:
Open CyberChef
↓
Confirm interface loads
↓
Locate Operations
↓
Locate Recipe
↓
Locate Input
↓
Locate Output
This prepared me for the next task.
Task 3 — Navigating the Interface
This was one of the most important tasks.
CyberChef is divided into four primary areas:
1. Operations
2. Recipe
3. Input
4. Output
Understanding these four areas makes the entire tool much easier.
1. Operations Area
The Operations section contains CyberChef's available transformations.
Examples include:
From Base64
To Base64
From Hex
To Hex
ROT13
URL Encode
URL Decode
Extract IP addresses
Extract URLs
Extract email addresses
From Unix Timestamp
Instead of scrolling through everything, the search box can be used.
For example, search:
Base64
and relevant operations appear.
Operation Categories
Operations are organized into groups.
These may include areas such as:
Encoding / Decoding
Encryption
Hashing
Networking
Extractors
Data Formats
Compression
Date / Time
This organization becomes useful when I know roughly what kind of problem I am solving.
2. Recipe Area
The Recipe area is where operations are placed.
TryHackMe describes it as the heart of CyberChef because this is where operations are selected, ordered, and configured. (TryHackMe)
Example:
Recipe
From Base64
↓
URL Decode
↓
ROT13
The order matters.
For example:
From Base64
↓
From Hex
is not necessarily equivalent to:
From Hex
↓
From Base64
Auto Bake
CyberChef can process the recipe automatically whenever the input or recipe changes.
This is called:
Auto Bake
When enabled:
Change Input
↓
Recipe Runs Automatically
↓
Output Updates
BAKE!
If automatic processing is disabled, the recipe can be executed manually using:
BAKE!
Save / Load Recipe
CyberChef can also save recipes.
This is useful when repeatedly performing the same transformation.
For example:
From Base64
↓
Gunzip
↓
Extract URLs
could be saved and reused later.
3. Input Area
The Input area contains the data to be processed.
Data can typically be:
Typed
Pasted
Opened from a file
Dragged into the interface
TryHackMe also highlights options for multiple input tabs and loading files or folders. (TryHackMe)
4. Output Area
The Output area displays the result.
Conceptually:
INPUT
↓
RECIPE
↓
OUTPUT
The output can then be:
Copied
Saved
Reused as input
Replace Input With Output
One especially useful feature is:
Replace Input With Output
This is helpful when working through multiple layers.
For example:
Encoded String
↓
Decode Layer 1
↓
Replace Input
↓
Decode Layer 2
↓
Replace Input
↓
Continue
🛠️ Hands-On — Task 3
Operations Practiced
To Base64
From Base64
To Hex
ROT13
URL Encode
Example input:
Hello Analyst
Recipe:
To Hex
produces hexadecimal bytes.
Another independent example:
CyberChef
↓
ROT13
↓
Encrypted-looking text
↓
ROT13
↓
CyberChef
ROT13 is its own inverse.
The room uses operations such as Morse decoding, URL encoding, Base64, hexadecimal conversion, decimal conversion, and ROT13 to demonstrate the interface. (TryHackMe)
Task 4 — Before Anything Else
This task taught something more important than memorizing operations:
Think Before Using the Tool
CyberChef contains hundreds of operations.
Randomly dragging operations into the recipe is not an efficient investigation strategy.
Instead, the room encourages a structured thought process. (TryHackMe)
Step 1 — Define the Objective
First ask:
What am I trying to accomplish?
For example:
I found an unreadable string.
Goal:
Determine what the original message is.
Without a clear goal, I may waste time trying unrelated operations.
Step 2 — Understand the Input
Look at the data carefully.
Questions I can ask:
Does it contain only hexadecimal characters?
Does it end in "="?
Does it contain %20 or %2F?
Does it look like binary?
Does it contain URLs?
Does it contain IP addresses?
Is it a timestamp?
Recognizing patterns helps identify the correct operation.
Step 3 — Choose an Operation
Based on the evidence:
Looks like Base64
↓
Try From Base64
Looks like hexadecimal
↓
Try From Hex
Contains encoded URL characters
↓
Try URL Decode
Large text with indicators
↓
Try Extractors
Step 4 — Evaluate the Output
After running the recipe:
Did I achieve the objective?
If yes:
Finish
If not:
Re-evaluate input
↓
Modify recipe
↓
Try again
My CyberChef Investigation Workflow
1. Define objective
↓
2. Inspect input
↓
3. Identify likely format
↓
4. Select operation
↓
5. Run recipe
↓
6. Inspect output
↓
7. Repeat if necessary
This was one of the strongest lessons from the room.
🛠️ Hands-On — Task 4
Suppose I encounter:
SGVsbG8gQW5hbHlzdA==
I notice:
Letters
Numbers
Possible "=" padding
My thought process becomes:
Possible Base64
↓
Search "Base64"
↓
Use From Base64
↓
Check whether output is meaningful
The important skill is not memorizing the decoded result.
It is learning how to reason from the structure of the input.
Task 5 — Practice, Practice, Practice
This task introduces several highly useful CyberChef operations.
One category was especially relevant to defensive security:
Extractors
Extractors search large bodies of text and return specific types of information.
TryHackMe introduces extractors for IP addresses, URLs, and email addresses. (TryHackMe)
Extract IP Addresses
Imagine receiving a large incident log:
Thousands of lines
↓
Multiple IP addresses
↓
Need indicators quickly
Instead of manually searching every line:
Extract IP addresses
can locate valid IPv4 and IPv6 addresses.
Cybersecurity Use Case
Suppose a phishing email contains:
Text
URLs
Headers
IP addresses
Encoded content
An analyst can paste the material into CyberChef and extract network indicators quickly.
Extract Email Addresses
The:
Extract email addresses
operation finds patterns that resemble:
user@example.com
This can be useful when analyzing:
Phishing messages
Large text dumps
Incident logs
Email headers
Leaked datasets
Extract URLs
The:
Extract URLs
operation searches for URLs in the input.
For example, a suspicious document or email may contain multiple links hidden among other content.
Conceptually:
Large Input
↓
Extract URLs
↓
URL 1
URL 2
URL 3
Number-Base Conversion
CyberChef can also convert data between number systems.
Examples include:
Decimal
Binary
Hexadecimal
For example:
Decimal value
↓
To Binary
↓
Binary representation
This becomes useful in networking, reverse engineering, and low-level computing.
URL Encoding
URLs sometimes contain encoded characters.
For example:
space
may become:
%20
Other special characters can also be percent-encoded.
CyberChef provides:
URL Encode
URL Decode
for converting between these representations.
🛠️ Hands-On — Task 5
Operations Practiced
Extract IP addresses
Extract email addresses
Extract URLs
To Binary
URL Encode
Independent sample input:
SOC report:
Contact analyst@example.org.
Suspicious host: 192.0.2.55
Reference: https://example.org/report?id=15
Recipe:
Extract IP addresses
returns the IP indicator.
Switch the operation to:
Extract email addresses
and CyberChef returns the email.
Then:
Extract URLs
finds the URL.
This is the same methodology as the room without revealing its downloaded-file answers.
Task 6 — Your First Official Cook
This task combines everything learned earlier.
The goal is no longer:
Find one operation
but:
Understand the input
↓
Select the right operation
↓
Configure it
↓
Interpret the output
The room uses different operations involving IP extraction, Base64, URL decoding, Unix timestamps, and Base85. (TryHackMe)
I practiced each concept independently rather than publishing the exact challenge values.
Base64
Base64 is an encoding, not encryption.
This distinction is important:
Encryption
↓
Requires cryptographic protection/key
Encoding
↓
Changes representation
Base64 exists primarily to represent binary data using printable ASCII characters.
Hands-On Base64 Example
Input:
Learning CyberChef
Recipe:
To Base64
To reverse it:
From Base64
So:
Plaintext
↓
To Base64
↓
Encoded data
↓
From Base64
↓
Plaintext
URL Decoding
A URL may appear like:
https%3A%2F%2Fexample%2Ecom%2Ftraining
Recognizable patterns include:
%3A
%2F
%2E
That suggests:
URL Decode
The result becomes a normal readable URL.
Unix Timestamps
Unix timestamps represent time as the number of seconds since the Unix epoch.
CyberChef provides operations that can convert between:
Unix Timestamp
↕
Human-readable Date/Time
This is useful during:
Log analysis
Incident response
Forensics
Timeline analysis
because many systems record timestamps numerically.
Base85
CyberChef also supports less-common encodings such as:
Base85
The investigation approach remains the same:
Recognize / suspect encoding
↓
Select corresponding From operation
↓
Inspect output
The point is not memorizing every encoding.
It is knowing how to find and apply an operation.
🛠️ Hands-On — Task 6
Operations Used
Extract IP addresses
To Base64
From Base64
URL Decode
From Unix Timestamp
From Base85
Independent recipe example:
Input:
VHJ5SGFja01l
Possible process:
Input looks encoded
↓
Search Base64
↓
From Base64
↓
Inspect output
For more complicated data:
Input
↓
From Base64
↓
URL Decode
↓
Output
This demonstrates how operations can be chained into a recipe.
The Magic Operation
Another useful CyberChef feature worth remembering is:
Magic
If I do not know what encoding I am looking at, Magic can attempt to identify likely transformations.
Conceptually:
Unknown-looking Data
↓
Magic
↓
Possible Interpretation
CyberChef documentation used in other TryHackMe material also presents Magic as a way to guess useful decoding operations. (TryHackMe)
However:
Magic should support analysis, not replace understanding.
I still want to recognize patterns myself.
Task 7 — Conclusion
By the end of this room, CyberChef no longer felt like a website with hundreds of random buttons.
I now understand its structure:
CYBERCHEF
|
┌─────────────────┼─────────────────┐
| | |
OPERATIONS RECIPE INPUT
| | |
Encoding Chain Ops Text
Decoding Configure Files
Extractors Reorder Data
Conversion Save Logs
| | |
└─────────────────┼─────────────────┘
|
BAKE
|
v
OUTPUT
The room concludes that CyberChef is useful for data transformations ranging from common encodings to extracting indicators, while reminding learners that very large-scale processing may require other tools. (TryHackMe)
Complete CyberChef Workflow
My final workflow is:
Unknown / Interesting Data
↓
Define Objective
↓
Inspect Pattern
↓
Search Operations
↓
Build Recipe
↓
Bake
↓
Inspect Output
↓
Expected Result?
/ \
Yes No
| |
Finish Modify Recipe
|
└───────→ Repeat
Useful CyberChef Operations
| Operation | Purpose |
|---|---|
From Base64 |
Decode Base64 |
To Base64 |
Encode data as Base64 |
From Hex |
Decode hexadecimal representation |
To Hex |
Convert input to hexadecimal |
ROT13 |
Apply ROT13 substitution |
URL Encode |
Percent-encode URL characters |
URL Decode |
Decode percent-encoded URLs |
Extract IP addresses |
Extract IPv4/IPv6 addresses |
Extract email addresses |
Extract email addresses |
Extract URLs |
Extract URLs |
To Binary |
Convert data to binary |
From Unix Timestamp |
Convert Unix time |
From Base85 |
Decode Base85 |
Magic |
Suggest possible transformations |
Key Lessons Learned
1. Encoding Is Not Encryption
This is one of the most important distinctions.
Base64
Hex
URL Encoding
do not inherently provide confidentiality.
They change how data is represented.
Someone who knows the encoding can reverse it.
2. CyberChef Recipes Save Time
Instead of:
Use Tool 1
Copy result
Use Tool 2
Copy result
Use Tool 3
CyberChef allows:
Operation 1
↓
Operation 2
↓
Operation 3
↓
Final Result
inside a single workflow.
3. Pattern Recognition Matters
Examples:
SGVsbG8=
↓
Possibly Base64
48 65 6c 6c 6f
↓
Possibly Hex
%3A%2F%2F
↓
Likely URL Encoding
Recognizing these patterns makes analysis much faster.
4. Extractors Are Extremely Useful for SOC Work
Large logs may contain thousands of characters.
Instead of manually searching for indicators:
Extract IPs
Extract URLs
Extract Emails
can quickly isolate useful evidence.
5. Always Define the Goal First
The biggest mistake would be:
Randomly try operations
A better approach is:
What do I want?
↓
What does the input look like?
↓
Which operation fits?
6. Output Can Become New Input
Cybersecurity data often has multiple encoding layers.
For example:
Layer 1
↓
Decode
↓
Layer 2
↓
Decode
↓
Final Message
CyberChef's recipes and Replace Input With Output functionality make this much easier.
My Final Mental Model
SUSPICIOUS DATA
|
v
RECOGNIZE FORMAT
|
┌──────────────┼──────────────┐
| | |
Base64 Hex URL
| | |
└──────────────┼──────────────┘
|
OPERATIONS
|
v
RECIPE
|
v
BAKE
|
v
OUTPUT
|
┌───────┴───────┐
| |
Useful? No
| |
Done Modify Recipe
Ethical Learning Note
This article is a learning guide rather than an answer dump.
I included:
✅ CyberChef concepts
✅ Generic operation examples
✅ Recipe methodology
✅ Encoding recognition
✅ Extractor workflows
✅ Defensive-security use cases
while intentionally excluding:
❌ TryHackMe flags
❌ Task-file email answer
❌ Task-file IP answers
❌ Domain answer
❌ Exact conversion answers
❌ First Cook challenge outputs
❌ Direct task submissions
The goal is to document how I used CyberChef while leaving the actual TryHackMe exercises for other learners to solve themselves.
Resources
🌐 TryHackMe Room: CyberChef: The Basics
👨💻 TryHackMe Profile: sunnysharma11200
💻 GitHub Repository: tryhackme-writeups
✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev
Connect with Me
TryHackMe: sunnysharma11200
GitHub: SunnySharma04
Hashnode: cybersecurity-learning
LinkedIn: Sunny Sharma
Happy Learning! 🚀
