CyberChef on AWS User Guide

Overview

This image runs CyberChef 11.2.0, the open source "Cyber Swiss Army Knife" originally created by GCHQ, on Ubuntu 24.04 LTS. CyberChef is a web app for carrying out a huge range of cyber operations - encoding and decoding formats such as Base64, URL and hex, compression, computing hashes and checksums, symmetric encryption and decryption, character-encoding conversions, parsing of common network and file formats, regular-expression extraction and more than 400 operations in all - chained together in a drag-and-drop pipeline that shows input and output side by side.

CyberChef is purely client-side: every operation runs in the visitor's own browser using JavaScript, and no data is ever sent to a server. That makes it a low-risk way to handle sensitive material, and it means the appliance itself is refreshingly simple - there is no database, no authentication and no server-side backend. cloudimg serves the official pre-built release as static files behind nginx on port 80.

Because the tool has no login and holds nothing sensitive server-side, this image serves CyberChef openly on port 80, exactly as the upstream project intends a self-hosted instance to run. If you want to restrict who can reach it, do so at the network edge - see Restricting access below.

What is included:

• CyberChef 11.2.0, the official pre-built release bundle, pinned by sha256 and served as static files from /var/www/cyberchef
• nginx on port 80 serving the single-page app (index plus the assets/, images/ and modules/ directories)
• An unauthenticated /healthz endpoint for load balancer and uptime probes
• nginx.service and a one-shot cyberchef-firstboot.service as systemd units, enabled and active
• A per-instance info note at /root/cyberchef-info.txt written on first boot, recording the access URL (there is no login to record - CyberChef needs none)
• A fully patched Ubuntu 24.04 LTS base
• 24/7 cloudimg support

Connecting to your instance

Connect over SSH on port 22 using your EC2 key pair. The login user depends on the operating system variant you launched:

ssh ubuntu@<instance-public-ip>

The recommended instance type is m5.large (2 vCPU / 8 GiB RAM), which is comfortably more than enough - CyberChef does all its work in the browser, so the server only serves static files.

Step 1 - Launch from AWS Marketplace

Find the CyberChef - The Cyber Swiss Army Knife - AMI by cloudimg listing on AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration and Continue to Launch. Pick your region, instance type (m5.large), key pair, VPC and subnet. For the security group, open 22/tcp (SSH) from your management network and 80/tcp (HTTP) from the networks that should be able to reach CyberChef. Launch the instance and note its public IPv4 address.

Step 2 - Confirm the services are running

CyberChef is served by nginx on port 80. A one-shot cyberchef-firstboot.service runs once on first boot to record the access URL. Confirm both units are active and nginx is listening on port 80:

systemctl is-active nginx cyberchef-firstboot
sudo ss -tlnp | grep ':80 '

Expected output:

active
active
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*    users:(("nginx",pid=...))
LISTEN 0      511             [::]:80           [::]:*    users:(("nginx",pid=...))

Step 3 - Confirm the app is served

nginx serves an unauthenticated /healthz endpoint for load balancer probes, and the CyberChef single-page app at /. Confirm the health endpoint returns 200, the served page is CyberChef, and the JavaScript bundle loads:

curl -sI http://127.0.0.1/healthz | head -1
curl -s http://127.0.0.1/ | grep -o '<title>[^<]*</title>'
curl -s -o /dev/null -w 'assets/main.js -> HTTP %{http_code}\n' http://127.0.0.1/assets/main.js

Expected output:

HTTP/1.1 200 OK
<title>CyberChef</title>
assets/main.js -> HTTP 200

Step 4 - Inspect the static bundle on disk

The whole appliance is the official CyberChef release extracted into a single docroot. The entry HTML is published as index.html, alongside the assets/, images/ and modules/ directories:

ls -1 /var/www/cyberchef | head -12
du -sh /var/www/cyberchef

Expected output:

ChefWorker.js.LICENSE.txt
CyberChef_v11.2.0.html
...
assets
images
index.html
modules
72M /var/www/cyberchef

Step 5 - Read the per-instance access note

CyberChef has no login of any kind, so there is no password to retrieve. On the first boot of every instance, cyberchef-firstboot.service resolves the instance's public address via EC2 instance metadata and writes a short access note to a root-only file so you always know where to point your browser:

sudo cat /root/cyberchef-info.txt

Expected output:

# CyberChef appliance by cloudimg - access information
#
# CyberChef is 'The Cyber Swiss Army Knife': a purely client-side web app. There is no
# login, no account and no server-side data - every operation runs in your own browser.
# Open the URL below in a web browser to start using it. Because there is no login, restrict
# who can reach it at the network edge (security group, VPN or authenticating reverse proxy).
cyberchef_url=http://<instance-public-ip>/

When reaching CyberChef from your workstation, use the instance's public IP or DNS name.

Step 6 - Open CyberChef

Browse to http://<instance-public-ip>/. CyberChef opens with four panes: the searchable Operations catalogue on the left (481 operations), the Recipe you are building, the Input you want to transform, and the computed Output. There is no sign-in step - the tool loads immediately.

Step 7 - Build a recipe

To transform data, drag an operation from the Operations catalogue into the Recipe, then type or paste your data into the Input pane. With Auto Bake on (the default), the Output updates as you go. In the example below, a To Base64 operation encodes a line of plain text into Base64 in the Output pane - all in the browser, with nothing sent to the server. Operations stack, so you can chain several together (for example decode from one format and re-encode into another) into a repeatable recipe, and save or share it via the Recipe toolbar.

Step 8 - Explore the operations

CyberChef ships more than 400 operations, grouped into categories such as Data format, Encryption / Encoding, Hashing, Compression, Networking and Forensics. Expand a category, or use the search box, to find what you need. The Encryption / Encoding category alone includes AES, Blowfish, DES, Triple DES and many more - encrypt and decrypt with a key entirely in your browser.

Restricting access

CyberChef ships with no login because it holds nothing sensitive server-side - every operation runs in the visitor's browser and no input is ever uploaded or stored. The instance therefore serves the tool openly on port 80. To control who can reach the tool, restrict it at the network edge in whichever way suits you:

• Security group - narrow the inbound rule for port 80 to the specific source IP ranges (your office, VPN or bastion) that should have access, instead of 0.0.0.0/0.
• VPN or private subnet - place the instance in a private subnet and reach it over a VPN or bastion host, with no public IP at all.
• Authenticating reverse proxy - front CyberChef with a reverse proxy (nginx, Caddy, an Application Load Balancer with authentication, or an identity-aware proxy) that requires sign-in and terminates TLS for your own domain.

CyberChef serves plain HTTP on port 80; for production or shared access, terminate TLS in front of it with your own domain using one of the reverse-proxy options above.

Maintenance

• Nothing to back up: CyberChef stores no data - every operation runs in the browser and nothing is persisted on the server. The appliance is entirely stateless.
• Updating CyberChef: the release is pinned by sha256 for reproducibility. To move to a newer release, download the official release bundle from the CyberChef releases page, extract it into /var/www/cyberchef, and publish its entry HTML as index.html.
• Security updates: keep the OS patched with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed.
• TLS and access control: for shared or production use, front CyberChef with your own domain and a TLS-terminating reverse proxy, and restrict port 80 in the security group to the networks that need it.

Support

cloudimg provides 24/7/365 expert technical support for this image. Contact support@cloudimg.co.uk. CyberChef is Crown Copyright and licensed under the Apache License 2.0. This image is provided by cloudimg and is not affiliated with or endorsed by GCHQ; additional charges apply for build, maintenance and 24/7 support.