September 12, 2026
CyberChef: The Basics: Encoding, Decoding, and Data Extraction
Introduction
By Jonathan Sanfer
10 min read
Introduction
Welcome to my walkthrough of the room CyberChef: The Basics! This is the first room in the Defensive Security Tooling module of the Cyber Security 101 path.
In my previous article, Vulnerability Scanner Overview, we closed out the Security Solutions module by looking at how tools like OpenVAS help us find weaknesses before an attacker does. This room shifts gears entirely. Instead of scanning infrastructure, we open up CyberChef, a browser based tool that lets us decode, encode, and pick apart raw data by hand. Whether it is a suspicious string pulled from a log file or a blob of Base64 hiding a message, CyberChef gives us a visual way to figure out what it actually says.
Catch up on my previous article, Vulnerability Scanner Overview, by clicking the banner below.
What we will cover
- What CyberChef is and how the recipe based workflow works
- How to access CyberChef both online and as an offline copy
- The four main areas of the interface: Operations, Recipe, Input, and Output
- A repeatable four step thought process for tackling unknown data
- Hands on practice with extractors, date and time conversions, and data format operations
- A guided first cook combining multiple operations to solve a practical exercise
- Answers to every question in the room
Room Information
Before we dive into the tasks, here is a quick overview of the room details.
- Room Name: CyberChef: The Basics
- Path: Cyber Security 101
- Module: Defensive Security Tooling
- Topic: CyberChef, Data Encoding, Data Decoding, Base64, Extractors
- Difficulty: Easy
- Room Link: TryHackMe — CyberChef: The Basics
Task 1: Introduction
CyberChef is a simple, intuitive web based application designed to help with various data related tasks directly inside your browser. Think of it as a Swiss army knife for data, a toolbox packed with small tools that each do one job very well. These jobs range from simple encodings like XOR or Base64 all the way up to more involved operations like AES encryption or RSA decryption.
The tool is built around the idea of a recipe, which is simply a series of operations chained together and executed in order on whatever data you feed it. Before jumping into the interface, TryHackMe recommends a bit of familiarity with the Hashing Basics and Cryptography Basics rooms, since a lot of the operations we will use in CyberChef build directly on those concepts.
Task 2: Accessing the Tool
There are two convenient ways to get CyberChef running, and it is worth knowing both since one depends on an internet connection and the other does not.
The first is online access. All you need is a web browser and an internet connection, then you can open CyberChef directly through the hosted version of the tool. The second is running it offline or as a local copy. You can download the latest release file and run it locally on either Windows or Linux. As a best practice, it is worth grabbing the most stable release rather than a bleeding edge build, especially if you plan to use it regularly for casework.
Guided Walkthrough: Getting CyberChef Open
There is not much decoding to do in this task, but it is worth actually opening the tool before moving on so the interface is fresh in your browser for the next task. If you are following along online, load up the hosted CyberChef page. If you would rather work offline, grab the release archive and extract it locally, then open the included HTML file in your browser. Either route lands you on the same interface, so pick whichever fits your workflow.
Task 3: Navigating the Interface
CyberChef is made up of four main areas, each responsible for a different part of the workflow: Operations, Recipe, Input, and Output.
The Operations area is a searchable, categorized library of every operation CyberChef can perform, from From Morse Code and URL Encode to To Base64, To Hex, To Decimal, and ROT13. Hovering over any operation gives you a short description and a link out to further reading, which is handy when you stumble across something unfamiliar. The Recipe area is where the real work happens. You drag operations from the library into this pane, arrange them in order, and configure each one's arguments. It includes controls to save a recipe, load one back in later, and clear it entirely, along with the BAKE! button that runs the recipe against your input (or the Auto Bake checkbox if you would rather it run automatically as you type).
The Input area is where your raw data lives, whether typed, pasted, or dragged in as a file or folder, and it supports multiple tabs so you can compare different inputs side by side. The Output area mirrors that on the results side, letting you save the output to a file, copy it straight to your clipboard, or push it back into the input pane to chain further transformations on top of what you just produced.
Guided Walkthrough: Exploring the Panes
Spend a few minutes clicking through the Operations list and using the search bar at the top to look up a couple of operations mentioned in the task, such as From Base64. Notice which pane it lives in, then try dragging any operation into the Recipe pane just to see how the drag and drop interaction feels. You do not need to configure anything yet, just get comfortable identifying which of the four areas you are looking at, since the rest of the room assumes you can navigate between them quickly.
Questions and Answers
In which area can you find "From Base64"?
Answer:
operationsoperationsWhich area is considered the heart of the tool?
Answer:
RecipeRecipeTask 4: Before Anything Else
Before touching the interface again, it helps to have a repeatable thought process for tackling data you do not immediately recognize. This room breaks it into four steps: set a clear objective, load your data into the input area, choose the operations that fit your working theory, and check the output against your original goal.
Setting the objective first matters more than it might seem. If you found a gibberish string during an investigation, your objective might simply be "figure out if this string hides a readable message." From there you paste the data into the input pane, then pick operations based on whatever clues you have, for example trying a handful of encoding or encryption related operations like ROT13, From Base64, From Base85, or ROT47 if you suspect the string is encoded rather than encrypted. Finally, you check the output and ask whether it actually answers your original question. If it does not, you loop back and try a different operation or combination.
Questions and Answers
At which step would you determine, "What do I want to accomplish?
Answer:
11Task 5: Practice, Practice, Practice
This task walks through several operation categories you will use constantly, starting with Extractors. The Extract IP addresses operation pulls every valid IPv4 or IPv6 address out of a blob of text, Extract email addresses pulls out anything matching the anything@domain.com pattern, and Extract URLs pulls full URLs, provided the protocol such as http or ftp is present in the text (without it, there would be far too many false positives).
Next is Date and Time, covered by To UNIX Timestamp and From UNIX Timestamp. A UNIX timestamp is a 32 bit value representing the number of seconds since January 1, 1970 UTC, so these two operations let you convert freely between a human readable datetime string and its timestamp equivalent.
The last category covered here is Data Format, and it is worth understanding Base64 encoding by hand at least once rather than treating it as a black box. Each character is first converted to its 8 bit binary value, the bits are concatenated and re split into 6 bit groups, each 6 bit group is converted to a decimal index, and that index is looked up against the Base64 alphabet table to produce the final encoded character. Operations like From Base64, URL Decode, From Base85, and From Base58 all follow this same general idea of mapping between raw bytes and a restricted, human friendly character set. URL Decode specifically reverses percent encoding, turning sequences like %3A and %2F back into the raw characters they represent, such as : and /.
Guided Walkthrough: Extracting Hidden Data
Download the task files from the top of this task, then either paste the file's contents directly into the Input pane or use the Open file as input feature to load it straight from disk. From there, each question below only needs a single operation dropped into the Recipe pane, so it is worth building and clearing your recipe one question at a time rather than stacking everything together.
For the hidden email address, drop the Extract email addresses operation into the Recipe pane on its own and let it run against the full task file. The output narrows the entire wall of text down to a single match, so there is nothing left to guess at other than reading it off the screen.
For the hidden IP address, swap in the Extract IP addresses operation instead. Enable the IPv4 checkbox since the address you are after is an IPv4 style address, and also enable Remove local IPv4 addresses to filter out any private or loopback ranges that would otherwise clutter the results. What is left in the output is the one address ending in the octet given in the question.
For the domain question, clear the recipe again and add the Extract domains operation. Running it against the same task file returns two domains rather than one, so read through both entries in the output and pick the one that starts with the letter given in the question.
The binary conversion question uses a different input entirely: just the decimal number given in the question, typed directly into the Input pane rather than the task file. Build a two operation recipe with From Decimal first, using the default Space delimiter, followed by To Binary with a Space delimiter and a Byte Length of 8. The output gives you the 8 bit binary representation of that decimal value.
Finally, for the URL encoding question, clear the recipe once more and add a single URL Encode operation, making sure to tick Encode all special chars rather than leaving it unchecked. Paste the given link into the Input pane, and the fully percent encoded version of that URL appears in the Output pane.
Questions and Answers
What is the hidden email address?
Answer:
hidden@hotmail.comhidden@hotmail.comWhat is the hidden IP address that ends in .232?
Answer:
102.20.11.232102.20.11.232Which domain address starts with the letter "T"?
Answer:
TryHackMe.comTryHackMe.comWhat is the binary value of the decimal number 78?
Answer:
0100111001001110What is the URL encoded value of <https://tryhackme.com/r/careers>?
Answer:
https%3A%2F%2Ftryhackme%2Ecom%2Fr%2Fcareershttps%3A%2F%2Ftryhackme%2Ecom%2Fr%2FcareersTask 6: Your First Official Cook
This task pulls everything from the previous tasks together into one practical exercise, using the same file downloaded in Task 5 alongside a few new strings and values provided directly in the questions.
Guided Walkthrough: Building a Multi Step Recipe
Reuse the file from Task 5 for the first question. Drop the Extract IP addresses operation into a fresh recipe and enable the IPv4 checkbox, leaving the other options unchecked this time. The output returns more than one address, so read through the full list rather than stopping at the first result, since the one you want is identified only by its first and last octet in the question.
For the Base64 question, clear the recipe and add a single To Base64 operation, leaving the alphabet at its default A to Za to z0 to 9+/= setting. Type the given phrase directly into the Input pane and the encoded result appears in Output.
For the URL decoding question, swap in the URL Decode operation on its own, paste the percent encoded string into Input, and the raw URL appears in Output.
The timestamp question uses From UNIX Timestamp with the Units dropdown left on its default Seconds (s) setting. Type the numeric timestamp given in the question into the Input pane, and the corresponding datetime string appears in Output.
Finally, for the Base85 string, add a From Base85 operation. Leave the Alphabet dropdown on the !-u preset, enable Remove non-alphabet chars, and leave the All-zero group char on its default z setting. Paste the encoded string into Input, and the decoded plain text message appears in Output.
Questions and Answers
Using the file you downloaded in Task 5, which IP starts and ends with "10"?
Answer:
10.10.2.1010.10.2.10What is the base64 encoded value of the string "Nice Room!"?
Answer:
TmljZSBSb29tIQ==TmljZSBSb29tIQ==What is the URL decoded value for https%3A%2F%2Ftryhackme%2Ecom%2Fr%2Froom%2Fcyberchefbasics?
Answer:
https://tryhackme.com/r/room/cyberchefbasicshttps://tryhackme.com/r/room/cyberchefbasicsWhat is the datetime string for the Unix timestamp 1725151258?
Answer:
Sun 1 September 2024 00:40:58 UTCSun 1 September 2024 00:40:58 UTCWhat is the Base85 decoded string of the value <+oue+DGm>Ap%u7?
Answer:
This is fun!This is fun!Summary & Key Takeaways
CyberChef turned out to be exactly the kind of tool you keep a tab open for. Once the four areas click into place, building a recipe becomes second nature, and the manual Base64 walkthrough was a nice reminder of what is actually happening under the hood every time an operation runs. If you have not opened the tool yet, now is a great time to load a random string of your own and start experimenting.
Key lessons:
- CyberChef organizes work into four areas: Operations, Recipe, Input, and Output, and recipes are just ordered chains of operations
- The tool can run entirely offline, which matters when working with sensitive data or without internet access
- A clear four step process (objective, input, operations, output) keeps you from randomly guessing at encodings
- Extractors like
Extract IP addresses,Extract email addresses, andExtract URLsare fast ways to pull structured data out of messy text - Base64, Base85, and Base58 all follow the same underlying principle of mapping binary data onto a restricted character set
Next up is CAPA: The Basics, where we learn how to use CAPA to automatically identify capabilities hidden inside executable files. Click the banner below to check it out!
If you found this walkthrough helpful, consider following me here on Medium to catch the next room analysis in this series.
You can also connect with me and follow my work across other platforms:
- 💼 LinkedIn:
- 🐦 X (Twitter):