# 👨‍🍳 TryHackMe — CyberChef: The Basics | Learning Guide

> **Spoiler-Free Learning Guide:** This article contains **no TryHackMe flags, challenge-file answers, or direct task solutions**. It focuses on CyberChef concepts, methodology, operations, recipes, and hands-on examples using independent sample data.

## Introduction

After learning about networking, Windows, command-line tools, and SIEM, I moved on to a tool that appears repeatedly across cybersecurity tasks:

# CyberChef

CyberChef is often described as the:

```text
Swiss Army knife of cybersecurity
```

It is a browser-based application that can perform a huge variety of data transformations without requiring us to write scripts for every small task.

Some examples include:

```text
Base64 encoding / decoding
Hex conversion
URL encoding / decoding
ROT13
Binary conversion
Hashing
Encryption / decryption
Extracting IP addresses
Extracting email addresses
Extracting URLs
Working with timestamps
```

What makes CyberChef especially useful is that these operations can be **combined into recipes**.

For example:

```text
Input
  ↓
From Base64
  ↓
From Hex
  ↓
ROT13
  ↓
Output
```

Instead of manually using three different websites or scripts, CyberChef can perform the whole sequence inside one interface.

TryHackMe's room introduces what CyberChef is, how to navigate its four main areas, how operations and recipes work, and how to apply common transformations and extractors. ([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

The room follows this structure:

```text
Introduction
      ↓
Accessing the Tool
      ↓
Navigating the Interface
      ↓
Thinking Before Cooking
      ↓
Practice
      ↓
Your First Official Cook
      ↓
Conclusion
```

* * *

# Task 1 — Introduction

The first task introduces CyberChef as a general-purpose data transformation tool.

Cybersecurity regularly involves encountering data that does not immediately make sense.

For example:

```text
SGVsbG8gV29ybGQ=
```

or:

```text
48 65 6c 6c 6f
```

or:

```text
https%3A%2F%2Fexample.com
```

These may initially appear unreadable, but they represent data encoded in different ways.

Instead of manually converting each format, CyberChef provides operations specifically designed for these tasks.

* * *

## The Main CyberChef Idea

The workflow is:

```text
DATA
  ↓
OPERATION
  ↓
RESULT
```

For example:

```text
Text
  ↓
To Base64
  ↓
Base64-encoded text
```

But CyberChef becomes more powerful when several operations are chained:

```text
Input
   ↓
Operation 1
   ↓
Operation 2
   ↓
Operation 3
   ↓
Final Output
```

This chain is called a:

# Recipe

CyberChef officially describes recipes as a sequence of operations executed in order. ([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

* * *

## Why CyberChef Is Useful in Cybersecurity

CyberChef can help when working with:

```text
Incident-response logs
Suspicious strings
Encoded URLs
Email artifacts
Malware indicators
Network data
CTF challenges
Forensic evidence
Obfuscated data
```

For example, an analyst might encounter:

```text
Encoded PowerShell
```

or:

```text
An unfamiliar hexadecimal string
```

or:

```text
A block of text containing many IP addresses
```

CyberChef allows that data to be transformed or extracted quickly.

* * *

## 🛠️ Hands-On — Task 1

### Tools Used

```text
CyberChef
Web Browser
TryHackMe Room
```

A simple independent example:

Input:

```text
Cyber Security
```

Apply:

```text
To Base64
```

The output becomes an encoded representation.

Then add:

```text
From Base64
```

after it.

The complete recipe becomes:

```text
Cyber Security
      ↓
To Base64
      ↓
From Base64
      ↓
Cyber Security
```

This simple example demonstrates an important principle:

> Operations are executed from top to bottom in the recipe.

* * *

# Task 2 — Accessing the Tool

CyberChef does not require a complicated installation process.

TryHackMe introduces two convenient ways to use it:

```text
Online
or
Local / Offline
```

([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

* * *

# Online CyberChef

The easiest option is the browser version.

Conceptually:

```text
Browser
   ↓
CyberChef
   ↓
Paste Input
   ↓
Create Recipe
   ↓
Get Output
```

This is useful when working with ordinary training data.

* * *

# Offline CyberChef

CyberChef can also be downloaded and run locally.

This is important from a security perspective.

Imagine working with:

```text
Sensitive incident logs
Confidential company data
Malware samples
Private forensic evidence
```

Uploading sensitive material to random online services may be inappropriate.

A local CyberChef copy allows processing to remain on the analyst's own machine.

* * *

## Security Lesson

Whenever using online tools, I should ask:

> Is this data safe to paste into a third-party website?

For public training data:

```text
Usually fine
```

For confidential corporate evidence:

```text
Think carefully
```

Offline tooling may be safer.

* * *

## 🛠️ Hands-On — Task 2

### Tools Used

```text
Web Browser
Online CyberChef
Offline CyberChef option
```

My workflow was simply:

```text
Open CyberChef
      ↓
Confirm interface loads
      ↓
Locate Operations
      ↓
Locate Recipe
      ↓
Locate Input
      ↓
Locate Output
```

This prepared me for the next task.

* * *

# Task 3 — Navigating the Interface

This was one of the most important tasks.

CyberChef is divided into **four primary areas**:

```text
1. Operations
2. Recipe
3. Input
4. Output
```

([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

Understanding these four areas makes the entire tool much easier.

* * *

# 1\. Operations Area

The **Operations** section contains CyberChef's available transformations.

Examples include:

```text
From Base64
To Base64
From Hex
To Hex
ROT13
URL Encode
URL Decode
Extract IP addresses
Extract URLs
Extract email addresses
From Unix Timestamp
```

Instead of scrolling through everything, the search box can be used.

For example, search:

```text
Base64
```

and relevant operations appear.

* * *

## Operation Categories

Operations are organized into groups.

These may include areas such as:

```text
Encoding / Decoding
Encryption
Hashing
Networking
Extractors
Data Formats
Compression
Date / Time
```

This organization becomes useful when I know roughly what kind of problem I am solving.

* * *

# 2\. Recipe Area

The **Recipe** area is where operations are placed.

TryHackMe describes it as the heart of CyberChef because this is where operations are selected, ordered, and configured. ([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

Example:

```text
Recipe

From Base64
      ↓
URL Decode
      ↓
ROT13
```

The order matters.

For example:

```text
From Base64
↓
From Hex
```

is not necessarily equivalent to:

```text
From Hex
↓
From Base64
```

* * *

## Auto Bake

CyberChef can process the recipe automatically whenever the input or recipe changes.

This is called:

```text
Auto Bake
```

When enabled:

```text
Change Input
     ↓
Recipe Runs Automatically
     ↓
Output Updates
```

* * *

## BAKE!

If automatic processing is disabled, the recipe can be executed manually using:

```text
BAKE!
```

* * *

## Save / Load Recipe

CyberChef can also save recipes.

This is useful when repeatedly performing the same transformation.

For example:

```text
From Base64
↓
Gunzip
↓
Extract URLs
```

could be saved and reused later.

* * *

# 3\. Input Area

The Input area contains the data to be processed.

Data can typically be:

```text
Typed
Pasted
Opened from a file
Dragged into the interface
```

TryHackMe also highlights options for multiple input tabs and loading files or folders. ([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

* * *

# 4\. Output Area

The Output area displays the result.

Conceptually:

```text
INPUT
   ↓
RECIPE
   ↓
OUTPUT
```

The output can then be:

```text
Copied
Saved
Reused as input
```

* * *

## Replace Input With Output

One especially useful feature is:

```text
Replace Input With Output
```

This is helpful when working through multiple layers.

For example:

```text
Encoded String
      ↓
Decode Layer 1
      ↓
Replace Input
      ↓
Decode Layer 2
      ↓
Replace Input
      ↓
Continue
```

* * *

## 🛠️ Hands-On — Task 3

### Operations Practiced

```text
To Base64
From Base64
To Hex
ROT13
URL Encode
```

Example input:

```text
Hello Analyst
```

Recipe:

```text
To Hex
```

produces hexadecimal bytes.

Another independent example:

```text
CyberChef
   ↓
ROT13
   ↓
Encrypted-looking text
   ↓
ROT13
   ↓
CyberChef
```

ROT13 is its own inverse.

The room uses operations such as Morse decoding, URL encoding, Base64, hexadecimal conversion, decimal conversion, and ROT13 to demonstrate the interface. ([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

* * *

# Task 4 — Before Anything Else

This task taught something more important than memorizing operations:

# Think Before Using the Tool

CyberChef contains hundreds of operations.

Randomly dragging operations into the recipe is not an efficient investigation strategy.

Instead, the room encourages a structured thought process. ([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

* * *

# Step 1 — Define the Objective

First ask:

> What am I trying to accomplish?

For example:

```text
I found an unreadable string.

Goal:
Determine what the original message is.
```

Without a clear goal, I may waste time trying unrelated operations.

* * *

# Step 2 — Understand the Input

Look at the data carefully.

Questions I can ask:

```text
Does it contain only hexadecimal characters?

Does it end in "="?

Does it contain %20 or %2F?

Does it look like binary?

Does it contain URLs?

Does it contain IP addresses?

Is it a timestamp?
```

Recognizing patterns helps identify the correct operation.

* * *

# Step 3 — Choose an Operation

Based on the evidence:

```text
Looks like Base64
      ↓
Try From Base64

Looks like hexadecimal
      ↓
Try From Hex

Contains encoded URL characters
      ↓
Try URL Decode

Large text with indicators
      ↓
Try Extractors
```

* * *

# Step 4 — Evaluate the Output

After running the recipe:

> Did I achieve the objective?

If yes:

```text
Finish
```

If not:

```text
Re-evaluate input
      ↓
Modify recipe
      ↓
Try again
```

* * *

## My CyberChef Investigation Workflow

```text
1. Define objective
        ↓
2. Inspect input
        ↓
3. Identify likely format
        ↓
4. Select operation
        ↓
5. Run recipe
        ↓
6. Inspect output
        ↓
7. Repeat if necessary
```

This was one of the strongest lessons from the room.

* * *

## 🛠️ Hands-On — Task 4

Suppose I encounter:

```text
SGVsbG8gQW5hbHlzdA==
```

I notice:

```text
Letters
Numbers
Possible "=" padding
```

My thought process becomes:

```text
Possible Base64
      ↓
Search "Base64"
      ↓
Use From Base64
      ↓
Check whether output is meaningful
```

The important skill is not memorizing the decoded result.

It is learning **how to reason from the structure of the input**.

* * *

# Task 5 — Practice, Practice, Practice

This task introduces several highly useful CyberChef operations.

One category was especially relevant to defensive security:

# Extractors

Extractors search large bodies of text and return specific types of information.

TryHackMe introduces extractors for **IP addresses, URLs, and email addresses**. ([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

* * *

# Extract IP Addresses

Imagine receiving a large incident log:

```text
Thousands of lines
      ↓
Multiple IP addresses
      ↓
Need indicators quickly
```

Instead of manually searching every line:

```text
Extract IP addresses
```

can locate valid IPv4 and IPv6 addresses.

* * *

## Cybersecurity Use Case

Suppose a phishing email contains:

```text
Text
URLs
Headers
IP addresses
Encoded content
```

An analyst can paste the material into CyberChef and extract network indicators quickly.

* * *

# Extract Email Addresses

The:

```text
Extract email addresses
```

operation finds patterns that resemble:

```text
user@example.com
```

This can be useful when analyzing:

```text
Phishing messages
Large text dumps
Incident logs
Email headers
Leaked datasets
```

* * *

# Extract URLs

The:

```text
Extract URLs
```

operation searches for URLs in the input.

For example, a suspicious document or email may contain multiple links hidden among other content.

Conceptually:

```text
Large Input
      ↓
Extract URLs
      ↓
URL 1
URL 2
URL 3
```

* * *

# Number-Base Conversion

CyberChef can also convert data between number systems.

Examples include:

```text
Decimal
Binary
Hexadecimal
```

For example:

```text
Decimal value
     ↓
To Binary
     ↓
Binary representation
```

This becomes useful in networking, reverse engineering, and low-level computing.

* * *

# URL Encoding

URLs sometimes contain encoded characters.

For example:

```text
space
```

may become:

```text
%20
```

Other special characters can also be percent-encoded.

CyberChef provides:

```text
URL Encode
URL Decode
```

for converting between these representations.

* * *

## 🛠️ Hands-On — Task 5

### Operations Practiced

```text
Extract IP addresses
Extract email addresses
Extract URLs
To Binary
URL Encode
```

Independent sample input:

```text
SOC report:
Contact analyst@example.org.
Suspicious host: 192.0.2.55
Reference: https://example.org/report?id=15
```

Recipe:

```text
Extract IP addresses
```

returns the IP indicator.

Switch the operation to:

```text
Extract email addresses
```

and CyberChef returns the email.

Then:

```text
Extract URLs
```

finds the URL.

This is the same methodology as the room without revealing its downloaded-file answers.

* * *

# Task 6 — Your First Official Cook

This task combines everything learned earlier.

The goal is no longer:

```text
Find one operation
```

but:

```text
Understand the input
      ↓
Select the right operation
      ↓
Configure it
      ↓
Interpret the output
```

The room uses different operations involving IP extraction, Base64, URL decoding, Unix timestamps, and Base85. ([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

I practiced each concept independently rather than publishing the exact challenge values.

* * *

# Base64

Base64 is an **encoding**, not encryption.

This distinction is important:

```text
Encryption
    ↓
Requires cryptographic protection/key

Encoding
    ↓
Changes representation
```

Base64 exists primarily to represent binary data using printable ASCII characters.

* * *

## Hands-On Base64 Example

Input:

```text
Learning CyberChef
```

Recipe:

```text
To Base64
```

To reverse it:

```text
From Base64
```

So:

```text
Plaintext
   ↓
To Base64
   ↓
Encoded data
   ↓
From Base64
   ↓
Plaintext
```

* * *

# URL Decoding

A URL may appear like:

```text
https%3A%2F%2Fexample%2Ecom%2Ftraining
```

Recognizable patterns include:

```text
%3A
%2F
%2E
```

That suggests:

```text
URL Decode
```

The result becomes a normal readable URL.

* * *

# Unix Timestamps

Unix timestamps represent time as the number of seconds since the Unix epoch.

CyberChef provides operations that can convert between:

```text
Unix Timestamp
      ↕
Human-readable Date/Time
```

This is useful during:

```text
Log analysis
Incident response
Forensics
Timeline analysis
```

because many systems record timestamps numerically.

* * *

# Base85

CyberChef also supports less-common encodings such as:

```text
Base85
```

The investigation approach remains the same:

```text
Recognize / suspect encoding
      ↓
Select corresponding From operation
      ↓
Inspect output
```

The point is not memorizing every encoding.

It is knowing how to find and apply an operation.

* * *

## 🛠️ Hands-On — Task 6

### Operations Used

```text
Extract IP addresses
To Base64
From Base64
URL Decode
From Unix Timestamp
From Base85
```

Independent recipe example:

Input:

```text
VHJ5SGFja01l
```

Possible process:

```text
Input looks encoded
       ↓
Search Base64
       ↓
From Base64
       ↓
Inspect output
```

For more complicated data:

```text
Input
   ↓
From Base64
   ↓
URL Decode
   ↓
Output
```

This demonstrates how operations can be chained into a recipe.

* * *

# The Magic Operation

Another useful CyberChef feature worth remembering is:

```text
Magic
```

If I do not know what encoding I am looking at, Magic can attempt to identify likely transformations.

Conceptually:

```text
Unknown-looking Data
        ↓
       Magic
        ↓
Possible Interpretation
```

CyberChef documentation used in other TryHackMe material also presents Magic as a way to guess useful decoding operations. ([TryHackMe](https://tryhackme.com/room/introtologanalysis?utm_source=chatgpt.com))

However:

> Magic should support analysis, not replace understanding.

I still want to recognize patterns myself.

* * *

# Task 7 — Conclusion

By the end of this room, CyberChef no longer felt like a website with hundreds of random buttons.

I now understand its structure:

```text
                    CYBERCHEF
                         |
       ┌─────────────────┼─────────────────┐
       |                 |                 |
   OPERATIONS         RECIPE            INPUT
       |                 |                 |
 Encoding            Chain Ops          Text
 Decoding            Configure          Files
 Extractors          Reorder            Data
 Conversion          Save               Logs
       |                 |                 |
       └─────────────────┼─────────────────┘
                         |
                       BAKE
                         |
                         v
                       OUTPUT
```

The room concludes that CyberChef is useful for data transformations ranging from common encodings to extracting indicators, while reminding learners that very large-scale processing may require other tools. ([TryHackMe](https://tryhackme.com/room/cyberchefbasics?utm_source=chatgpt.com))

* * *

# Complete CyberChef Workflow

My final workflow is:

```text
Unknown / Interesting Data
          ↓
Define Objective
          ↓
Inspect Pattern
          ↓
Search Operations
          ↓
Build Recipe
          ↓
Bake
          ↓
Inspect Output
          ↓
Expected Result?
       /        \
     Yes         No
      |           |
   Finish     Modify Recipe
                  |
                  └───────→ Repeat
```

* * *

# Useful CyberChef Operations

| Operation | Purpose |
| --- | --- |
| `From Base64` | Decode Base64 |
| `To Base64` | Encode data as Base64 |
| `From Hex` | Decode hexadecimal representation |
| `To Hex` | Convert input to hexadecimal |
| `ROT13` | Apply ROT13 substitution |
| `URL Encode` | Percent-encode URL characters |
| `URL Decode` | Decode percent-encoded URLs |
| `Extract IP addresses` | Extract IPv4/IPv6 addresses |
| `Extract email addresses` | Extract email addresses |
| `Extract URLs` | Extract URLs |
| `To Binary` | Convert data to binary |
| `From Unix Timestamp` | Convert Unix time |
| `From Base85` | Decode Base85 |
| `Magic` | Suggest possible transformations |

* * *

# Key Lessons Learned

## 1\. Encoding Is Not Encryption

This is one of the most important distinctions.

```text
Base64
Hex
URL Encoding
```

do not inherently provide confidentiality.

They change how data is represented.

Someone who knows the encoding can reverse it.

* * *

## 2\. CyberChef Recipes Save Time

Instead of:

```text
Use Tool 1
Copy result
Use Tool 2
Copy result
Use Tool 3
```

CyberChef allows:

```text
Operation 1
     ↓
Operation 2
     ↓
Operation 3
     ↓
Final Result
```

inside a single workflow.

* * *

## 3\. Pattern Recognition Matters

Examples:

```text
SGVsbG8=
      ↓
Possibly Base64
```

```text
48 65 6c 6c 6f
      ↓
Possibly Hex
```

```text
%3A%2F%2F
      ↓
Likely URL Encoding
```

Recognizing these patterns makes analysis much faster.

* * *

## 4\. Extractors Are Extremely Useful for SOC Work

Large logs may contain thousands of characters.

Instead of manually searching for indicators:

```text
Extract IPs
Extract URLs
Extract Emails
```

can quickly isolate useful evidence.

* * *

## 5\. Always Define the Goal First

The biggest mistake would be:

```text
Randomly try operations
```

A better approach is:

```text
What do I want?
      ↓
What does the input look like?
      ↓
Which operation fits?
```

* * *

## 6\. Output Can Become New Input

Cybersecurity data often has multiple encoding layers.

For example:

```text
Layer 1
  ↓
Decode
  ↓
Layer 2
  ↓
Decode
  ↓
Final Message
```

CyberChef's recipes and **Replace Input With Output** functionality make this much easier.

* * *

# My Final Mental Model

```text
                 SUSPICIOUS DATA
                       |
                       v
                RECOGNIZE FORMAT
                       |
        ┌──────────────┼──────────────┐
        |              |              |
      Base64          Hex            URL
        |              |              |
        └──────────────┼──────────────┘
                       |
                  OPERATIONS
                       |
                       v
                    RECIPE
                       |
                       v
                     BAKE
                       |
                       v
                    OUTPUT
                       |
               ┌───────┴───────┐
               |               |
            Useful?           No
               |               |
             Done          Modify Recipe
```

* * *

# Ethical Learning Note

This article is a **learning guide rather than an answer dump**.

I included:

```text
✅ CyberChef concepts
✅ Generic operation examples
✅ Recipe methodology
✅ Encoding recognition
✅ Extractor workflows
✅ Defensive-security use cases
```

while intentionally excluding:

```text
❌ TryHackMe flags
❌ Task-file email answer
❌ Task-file IP answers
❌ Domain answer
❌ Exact conversion answers
❌ First Cook challenge outputs
❌ Direct task submissions
```

The goal is to document how I used CyberChef while leaving the actual TryHackMe exercises for other learners to solve themselves.

* * *

# Resources

*   🌐 **TryHackMe Room:** [CyberChef: The Basics](https://tryhackme.com/room/cyberchefbasics)
    
*   👨‍💻 **TryHackMe Profile:** [sunnysharma11200](https://tryhackme.com/p/sunnysharma11200)
    
*   💻 **GitHub Repository:** [tryhackme-writeups](https://github.com/SunnySharma04/tryhackme-writeups)
    
*   ✍️ **Hashnode Blog:** [cybersecurity-learning.hashnode.dev](https://cybersecurity-learning.hashnode.dev/)
    

* * *

# Connect with Me

*   **TryHackMe:** [sunnysharma11200](https://tryhackme.com/p/sunnysharma11200)
    
*   **GitHub:** [SunnySharma04](https://github.com/SunnySharma04/tryhackme-writeups)
    
*   **Hashnode:** [cybersecurity-learning](https://cybersecurity-learning.hashnode.dev/)
    
*   **LinkedIn:** [Sunny Sharma](https://www.linkedin.com/in/sunny-sharma-2487312a7/)
    

* * *

*Happy Learning!* 🚀