CyberChef by cloudimg - Self-Hosted Cyber Swiss Army Knife AMI

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

CyberChef is a simple, intuitive web app for carrying out all manner of cyber operations in a browser. Encode and decode Base64, URL and many other formats; encrypt and decrypt with AES, DES and RSA; compress and decompress data; parse and translate hexdumps; work with hashes and checksums; and chain any of more than 400 operations together into a repeatable recipe. This AMI delivers CyberChef fully installed and served by nginx, so the tool is available in a browser within minutes of launch. The current release is CyberChef 11.2.0.

Downloading CyberChef from GitHub is free - so why use this AMI? This image eliminates the setup work so your team can focus on analysis, not infrastructure:

• Launch-ready deployment - CyberChef is pre-installed and served by nginx with systemd managing process restarts on failure. No manual package installation, web server configuration, or service file authoring required.
• Integrity-verified build - The official upstream release bundle is verified against a pinned checksum at build time, ensuring you run an unmodified, authentic copy.
• Deployment guide included - A paired guide walks through restricting access with security groups, placing the instance behind a VPN, fronting it with an authenticating reverse proxy, and adding HTTPS.
• 24/7 cloudimg support - Help with deployment, access restriction, HTTPS configuration, and upgrade planning via email and chat.

CyberChef is a purely client-side application. Every operation runs in the visitor's own browser: the data you paste, drop or type is processed locally by the page and is never uploaded to the server, never stored, and never sent anywhere. There is no database, no server-side backend and no account. This makes it ideal for working with sensitive investigation data, and means the appliance has no server-side data store to secure.

The image serves CyberChef over nginx on port 80 as the upstream project intends for self-hosted instances. HTTPS is not preconfigured out of the box; cloudimg support can assist with TLS setup using your own certificate or a reverse proxy. SSH access is key-based - password authentication is disabled on the base image. The appliance adds only nginx and a small set of supporting tools on top of a fully patched Linux base. Operators who want to restrict access can narrow the instance security group to trusted source addresses, place the instance behind a VPN, or front it with an authenticating reverse proxy. The paired deployment guide walks through each of these options.

The official pre-built CyberChef release bundle is served as static files by nginx. systemd starts nginx on boot and restarts it on failure. An unauthenticated health endpoint answers for load-balancer and uptime checks. On first boot a one-shot service records the instance address in a root-only note and an SSH message-of-the-day banner so operators know exactly where to reach the tool.

Open the instance address in your browser and CyberChef loads immediately with no sign-in step. Drag an input in, pick operations from the catalogue, and build a recipe - everything computes in the browser.

• Security teams and SOCs - A self-hosted, private instance so analysts can decode, decrypt and transform data without sending it to a third-party site.
• CTF players and malware analysts - A shared browser toolkit for incident responders and competition teams.
• Developers and engineers - A convenient always-on data-conversion and cryptography workbench.

24/7 technical support by email and chat covering deployment assistance, security group and reverse proxy configuration, HTTPS setup, and upgrade planning.

All product and company names are trademarks or registered trademarks of their respective holders. CyberChef is Crown Copyright, published by GCHQ under the Apache License 2.0. Use of the name does not imply any affiliation with or endorsement by GCHQ.