Chris Collins

Tools · encoding

Data recipe

Chain operations on text or a dropped file and see the output after every step — encodings, gzip and deflate, hashes and HMAC, AES-GCM/CBC/CTR, XOR and XOR brute force, ROT13, text and CSV/JSON operations, timestamps, entropy and a byte histogram — with “magic” that guesses the decoding steps.

Added

How to use it

A recipe is a list of operations applied one after another, in the spirit of GCHQ’s CyberChef. Each step shows its own output underneath it, so when something odd turns up (a Base64 blob in a log, a cookie, a config value) you can peel it apart one layer at a time and see exactly where it stops making sense.

How to use it

  1. Type or paste into Input, or drop a file on it (or Open file). Files are read as bytes, so binary data works.

  2. Pick operations from the list on the left (on a phone, open Operations above the input). Type in the search box and press Enter to add the first match. Each step has its options, an on switch to bypass it, arrows to reorder it, and a peek at its output: the size, whether it is text or a known file type, and its entropy.

  3. ✨ Magic looks at the input (or, from the output panel, at the result so far) and suggests decoding chains — Base64, hex, Base32, Ascii85, binary, octal, decimal bytes, URL and HTML escapes, quoted-printable, Punycode, gzip and zlib headers, ROT13 that turns into English — trying a few steps deep and ranking the results by how readable they are. Add these steps puts them in the recipe.

  4. The Output shows text when the result is valid UTF-8 and a hex dump otherwise (or force either). Use as input starts a new recipe from the result.

Examples loads a few ready-made recipes: Base64 then gunzip, finding a one-byte XOR key, pulling URLs out of text, an AES-GCM round trip, and a string wrapped in three layers of encoding.

The operations

  • Encoding: Base64 (standard or URL-safe, padding, wrapping), Base32, Base85 (Ascii85), hex with any separator and a hex dump, URL encoding, HTML entities, quoted-printable, Punycode (whole domain names or raw), binary, octal, decimal bytes, Unicode character codes and \u escapes.

  • Compression: gzip, zlib and raw deflate, both ways, with the browser’s own CompressionStream; Decompress (auto) reads the header to pick the right one.

  • Hashing: SHA-1, SHA-256, SHA-384, SHA-512 (Web Crypto), MD5 and CRC-32, and HMAC with a text, hex or Base64 key — output as hex, Base64 or raw bytes so the result can feed the next step. For hashing big files, SHA-3 and comparing against a published checksum use hashes and checksums; for other CRC variants, the CRC calculator.

  • Encryption: AES in GCM, CBC (PKCS#7 padding) and CTR modes with Web Crypto. The key and IV can be hex, text or Base64. GCM output ends with its 16-byte tag, and a wrong key or tampered data says so. Tick IV goes before the ciphertext to write a random IV in front when encrypting, and to read it back from the first bytes when decrypting. Chrome does not accept 192-bit AES keys. Also XOR with a repeating key, XOR brute force (all 256 one-byte keys ranked by how English the result looks, with an optional crib), ROT13 or any Caesar shift, and ROT47. To break classical ciphers, use the classic cipher cracker.

  • Text: change case, reverse, sort, unique (with counts), find and replace with regular expressions, filter lines, extract URLs, email addresses, IPv4 and IPv6 addresses or domain names, split and join, remove whitespace, take a slice of bytes (handy for splitting an IV off the front), and counts. The text toolkit has many more case styles and line tools, and the regex tester helps with patterns.

  • Data: JSON beautify (optionally with sorted keys) and minify, CSV to JSON and back, and JSON string quoting. For JSONPath and diffs use the JSON workbench.

  • Time: Unix timestamps in seconds, milliseconds, microseconds or nanoseconds (guessed from the number of digits), Windows FILETIME and Apple’s 2001 epoch, to ISO 8601 — and dates back to Unix time. Time zones are in the timestamp converter.

  • Analysis: Shannon entropy with a block-by-block line (text sits near 4–5 bits per byte; compressed or encrypted data near 8), a byte histogram, and file-type detection from magic numbers. These pass the data through unchanged, so they can go anywhere in a recipe.

Related tools that go deeper on one thing: Base64 converter, URL encoder, Unicode inspector, JWT decoder, certificate decoder, SSH and PGP key inspector, binary formats (protobuf, MessagePack, CBOR), and UUIDs.

Saving and sharing recipes

Save keeps a named recipe in this browser; Export downloads it as JSON and Import takes JSON back (pasted or from a file), so recipes can live in a repository next to the data they decode. The format is {"steps": [{"op": "from_base64"}, {"op": "gunzip"}]}, with only the options that differ from the defaults.

Share link copies a link to the recipe. The input is left out unless you tick Include the input in share links (a dropped file never goes into a link), and keys for AES, HMAC and XOR are left out unless you tick Include keys.

Browser support

Any current browser. Compression needs CompressionStream (Chrome 80+, Safari 16.4+, Firefox 113+), and AES, HMAC and SHA need Web Crypto, which browsers only offer on https pages and localhost.

Privacy

Everything runs in this page; nothing you type, drop or decode is sent anywhere. The recipe and the typed input are remembered in this browser’s local storage so they are still here next time — keys are not remembered, and dropped files are not stored. Share links contain only what is described above.

Runs entirely in your browser; nothing you type leaves this page.