Input, Recipe & Output
What is it?
CyberChef's model is simple: you paste an INPUT, build a RECIPE (an ordered list of operations), and read the OUTPUT. Each operation transforms the previous step's output, so a recipe is a pipeline.
Why it matters
Framing decoding as a pipeline is what makes complex obfuscation tractable: you apply one transformation, look at the result, and decide the next — instead of guessing the whole chain at once.
Where you see it
Input: a Base64 blob. Recipe: From Base64 → Gunzip → (readable). Output updates live as you add operations.
What normal looks like
A short, ordered recipe where each step's output makes the next step obvious, ending in readable plaintext or a clear indicator.
What suspicious looks like
In your own process: stacking operations blindly without reading the intermediate output, so you cannot tell which step helped or broke the chain.
How analysts investigate
Add one operation at a time and read the output after each; the intermediate result tells you whether you chose the right transformation and what to try next.
Common beginner mistakes
- Adding several operations before reading any intermediate output.
- Getting the operation ORDER wrong (decode before decompress, etc.).
A recipe is a pipeline
INPUT → [ From Base64 ] → [ Gunzip ] → OUTPUT (readable)
read the output after EACH step:
after From Base64 → binary gzip magic (1F 8B) → add Gunzip
one step at a time; the intermediate output guides the nextQuick check
What is the best way to build a decoding recipe?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.