usefulweb.site Crypto Kitchen

Cryptography & security tools

Crypto Kitchen

CyberChef-style recipes: chain encodings, compression, hashes, AES, JWT and more, step by step.

Any file up to 10 MB, processed as raw bytes.

Syntax: op-id name=value name="value with spaces". Operations: to-base64, from-base64, to-base64url, to-base32, from-base32, to-base58, from-base58, to-hex (separator?), from-hex, to-hexdump, url-encode (all?), url-decode (plus?), html-encode (nonAscii?), html-decode, punycode-encode, punycode-decode, qp-encode, qp-decode, gzip (level?), gunzip, deflate, inflate, deflate-raw, inflate-raw, brotli-compress (quality?), brotli-decompress, hash (alg?, format?), hmac (alg?, key, format?), crc32, aes-encrypt (mode?, key, iv, aad?, padding?), aes-decrypt (mode?, key, iv, tag?, aad?, padding?), xor (key), rot13, caesar (shift?), vigenere-encode (key), vigenere-decode (key), jwt-decode, jwt-verify (key, alg?), uuid-parse, ulid-parse, timestamp (unit?), json-pretty (indent?, sortKeys?), json-minify, regex-extract (pattern, flags?, group?), text-case (mode?), reverse (unit?), byte-swap (width?), entropy, magic (depth?). Byte arguments accept hex:, b64: or utf8: prefixes. Use @key to insert the secret field.

Optional: HMAC/JWT secret or a PEM/JWK public key for jwt-verify. Hidden in the results.

Try an example: Base64 → gunzip → pretty JSON · AES-256-GCM round trip with entropy check · Verify an HS256 JWT · Magic: auto-detect and decode · HMAC-SHA256 and hash of a file-like input · Regex extract e-mail domains, then upper case · Gzip to binary (download)

How it works

Write a recipe of operations, one per line, and run text or a file (up to 10 MB) through it: base64/32/58, hex, URL, HTML entities, Punycode and quoted-printable, gzip/deflate/brotli, hashes and HMAC, AES-GCM/CBC/CTR, XOR, ROT13/Caesar/Vigenère, JWT decode and verify, UUID/ULID parsing, timestamps, JSON, regex extraction, text case, byte swap, entropy and a Magic auto-decoder. Every intermediate result is shown; binary output can be downloaded.

  • The input (pasted text, hex, base64 or an uploaded file) becomes a byte string; each recipe line is an operation that maps bytes to bytes. Text operations decode as UTF-8. The table shows every intermediate result; on an error the pipeline stops and reports the failing step.
  • Cryptography uses Node.js crypto (OpenSSL): AES-GCM appends/verifies the 16-byte tag, CBC uses PKCS#7 padding, CTR is a stream mode. You must supply key and IV, so results are reproducible; never reuse a GCM nonce with the same key.
  • JWT decode never checks signatures. jwt-verify supports HS256/384/512 (secret), RS*/PS* (RSA), ES256/384/512 (raw r||s signatures as in RFC 7518) and EdDSA with a PEM, certificate or JWK key, and refuses tokens whose header alg differs from the expected one.
  • Decompression stops at 50 MB of output to defuse decompression bombs; regex extraction runs in an isolated VM context with a 1-second limit.
  • Magic checks for gzip/zlib headers, JWTs, UUIDs/ULIDs, timestamps, JSON, percent-encoding, HTML entities, hex, base64/base64url, base32 and quoted-printable, and applies the most plausible decoder repeatedly while the output stays readable or reveals another known format.

Data and keys are processed on the server for this request only. Do not paste production secrets.

Sources

For scripts and AI agents

  • JSON API: POST https://cryptokitchen.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://cryptokitchen.usefulweb.site/mcp · tool name crypto_kitchen
Example request
curl -s -X POST https://cryptokitchen.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{"input":"H4sIAAAAAAACA6tWKi1OLVKyUkpMSVTSUSrKz0ktVrKKVkpMyc3MU9JRSkktU4rVUUpMLsksS1WyKikqTa0FAJsiBuU0AAAA","recipe":"from-base64\ngunzip\njson-pretty"}'

Related tools

  • CyberChef-lite Pipeline – One-click decoding recipes: JWT, base64 → gunzip → JSON, double URL decode, hex dump.
  • RSA/ECC Key Inspector – Inspect PEM, DER, JWK or OpenSSH keys: type, size, curve, fingerprints, thumbprint and weaknesses.
Feedback