Run CyberChef Locally: Encode, Decrypt & Analyse Data

// Before you start

What you need

Docker Desktop installed and running on your machine
A web browser (Chrome 50+ or Firefox 38+)
A stable internet connection for the first pull

Step 1 of 5

Confirm Docker is running

1 min

Before anything else, make sure Docker Desktop is open and active. If it is not running, the next commands will fail immediately. Look for the Docker whale icon in your system tray or menu bar — it should say 'Docker Desktop is running'.

Terminal · mac

$ docker --version

What you should see

Docker version 24.x.x, build xxxxxxx (any recent version is fine)

This might happen

Command not found or 'Cannot connect to the Docker daemon'

Open Docker Desktop from your Applications or Start menu and wait until it shows 'Running', then try again.

Step 2 of 5

Pull and run the pre-built CyberChef image

2 min

This single command downloads the official CyberChef image from GitHub's container registry and starts it. The '-p 8080:8080' part maps port 8080 on your computer to the app inside Docker, so your browser can reach it. The download is roughly 200 MB and only happens once.

Terminal · mac

$ docker run -it -p 8080:8080 ghcr.io/gchq/cyberchef:latest

What you should see

You should see log lines ending with something like 'Server running on port 8080'. The terminal will stay open — that is normal.

This might happen

Port 8080 is already in use

Change the left side of the port mapping: use '-p 9090:8080' instead, then open http://localhost:9090 in your browser.

Step 3 of 5

Open CyberChef in your browser

1 min

With the container running, open your browser and go to the address below. You will see the full CyberChef interface: an operations list on the left, a recipe area in the middle, and input/output boxes on the right. Nothing you type here is ever sent to any server — all processing happens inside your own browser.

Terminal · mac

$ http://localhost:8080

What you should see

The CyberChef web interface loads with the GCHQ logo and a search bar for operations.

This might happen

Page does not load or shows 'connection refused'

Check that the Docker terminal from Step 2 is still open and has not errored. Do not close that terminal window while using CyberChef.

Step 4 of 5

Run your first recipe: decode a Base64 string

2 min

Try the tool with a quick test. In the Input box (top right), paste the sample text below. Then type 'From Base64' in the operations search bar on the left and drag that operation into the Recipe area in the middle. CyberChef will instantly decode it and show the result in the Output box. This confirms everything is working.

Terminal · mac

$ SGVsbG8gZnJvbSBDeWJlckNoZWYh

What you should see

Output box shows: Hello from CyberChef!

Step 5 of 5

Stop CyberChef when you are done

1 min

When you are finished, go back to the terminal window that is running Docker and press the key combination below. This stops the container cleanly. Next time you want CyberChef, just run the Step 2 command again — it will start instantly because the image is already downloaded.

Terminal · mac

$ Ctrl + C

What you should see

The terminal returns to a normal prompt and the container stops.

This might happen

Ctrl+C does not stop it

Open a new terminal and run: docker ps — find the container ID, then run: docker stop <container-id>

// Status

cooked. baked. worked.

A fully working, private, local copy of CyberChef running in your browser. You can encode, decode, encrypt, hash, and analyse data without sending anything to an external server.

// the honest bit

The honest part

CyberChef is a manual tool — you drag operations and inspect results yourself. It does not automate workflows or connect to other systems. The 'Automagic' detection is helpful but not always correct; always verify sensitive results. Some heavy operations (large file hashing, complex decryption chains) can be slow or freeze a low-memory browser tab. This guide uses the pre-built image; building from source takes 10+ minutes and requires Node.js knowledge.