A lot of CTF "crypto" is really just encoding layered on encoding — Base64 wrapped around hex wrapped around a Caesar shift, none of it cryptographically strong, all of it tedious to peel back by hand. CyberChef (built by GCHQ, runs entirely in the browser) turns that into a drag-and-drop pipeline: chain operations together and watch the output update live as you build it.
1. The recipe model
CyberChef's left panel lists every operation (From Base64, XOR, ROT13, hex decode, and hundreds more); drag one into the Recipe panel and it runs immediately on whatever you pasted into Input. Stack a second operation underneath the first and its output feeds straight into it — a Base64-encoded, then hex-encoded string decodes in two drags, no code required.
Input: 53474656 6247567a...
Recipe: From Hex → From Base64
Output: (the decoded plaintext)2. Let Magic guess the recipe
When you don't know what's been done to a string, drag in the Magic operation and let it try. It brute-forces combinations of common encodings and ciphers against your input and ranks the results by how plausible the output looks (readable text scores higher than noise) — often landing on the exact recipe you'd have spent ten minutes guessing manually.
3. XOR against a key
The XOR operation takes a key in hex, UTF-8, or Base64 and applies it directly — useful the moment you've recovered a repeating-key XOR key by other means and just need to decrypt the rest of the ciphertext with it. XOR Brute Force goes a step further: give it a crib (a substring you expect to appear in the plaintext, like flag{) and it searches single-byte keys for one that produces it.
4. Save recipes you'll reuse
Once a recipe works, the Save recipe button turns it into a shareable link or a local file — handy for a multi-stage challenge where you'll re-run the same decode chain on several ciphertexts, or for keeping a personal library of "encodings I've seen before" recipes across events.
Wrapping up
CyberChef won't replace real cryptanalysis, but for the very common case of "someone encoded this data one or more times and I need to reverse it," it's faster than reaching for a Python shell every time. Pair it with Magic when you're not sure what you're looking at, and build a manual recipe once you are. See our Common Weak Ciphers in Crypto CTFs for the patterns CyberChef is usually decoding, and browse writeups for full examples.